Cyber Essentials in plain English: what it is and how to pass
Last week we covered hidden email rules and why a password reset alone doesn’t fix a hacked account. This week takes a step back to the basics that stop most attacks in the first place, and the certificate that proves you have them.
Three days before the tender deadline
A Greater Manchester physiotherapy group called us three days before a contract renewal deadline. They had held the contract for six years. The new tender form had one question the old one didn’t: “Do you hold Cyber Essentials?”
They didn’t, and the practice manager wasn’t sure what it involved. The tender didn’t say “preferred”. It said “required”.
We ran through the self-assessment with them that afternoon. Most of it was already in place. They had a firewall, antivirus on every machine and sensible passwords.
Three things would have failed them. Two staff accounts had multi-factor authentication switched off, which became an automatic fail in April. One reception laptop hadn’t installed updates since the spring. And a scheduling app nobody thought of as IT held patient appointment data with no two-step login at all.
We fixed all three in a morning. They submitted with a day to spare, and they kept the contract.
Why this matters
Government research found that organisations with Cyber Essentials in place make 80% fewer cyber insurance claims than organisations with the same policy and no certification (GOV.UK, 2024).
The standard changed on 27 April 2026. Under the new Danzell question set and version 3.3 of the requirements, cloud services can no longer be excluded from scope, and leaving available multi-factor authentication switched off now causes automatic failure (IASME, 2026).
The fix
The five controls are firewalls, secure configuration, security update management, user access control and malware protection (NCSC). In plain terms, that means blocking what shouldn’t get in, removing default settings and unused accounts, keeping everything updated, making sure people can only reach what they need, and running protection against malicious software.
The April changes affect small businesses most. Your Microsoft 365, accounts package, CRM, booking system and even business social media accounts now all count as in scope. If any of them offers two-step login, it has to be on for every user. That’s why passkeys help here, because the updated standard now explicitly recognises passwordless sign-in, including FIDO2.
There are two levels. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an assessor. Most businesses start with the first. We help clients through both with our Cyber Essentials service.
Three quick wins you can act on this week
🏠 At home
Use the same five checks on your own devices. Turn on automatic updates, set a proper screen lock, switch on two-step login for your email, and remove apps you don’t use. It’s the same thinking at a smaller scale.
🏢 At work
Make a list of every cloud service your business uses: email, file storage, accounts, payroll, CRM, booking systems and social media. Each one is now in scope, and each one needs multi-factor authentication switched on for every user wherever it’s offered.
🌍 For everyone
Install high-risk and critical updates within 14 days of release. That covers phones, laptops, apps and the router, because the new standard counts network devices too.
Getting certified, step by step
- Decide the scope: the whole organisation or a defined part of it, with exclusions explained.
- List every device, user account and cloud service inside that scope.
- Check each one against the five controls, starting with MFA and updates, since those cause automatic failures.
- Switch on MFA, install updates, remove unused accounts and change default passwords.
- Complete the self-assessment question set online through a certification body.
- A board-level person or the business owner signs the declaration, and the certificate lasts 12 months.
Cyber Essentials and Cyber Essentials Plus compared
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it’s assessed | Verified online self-assessment | Self-assessment plus a hands-on technical audit |
| Typical cost | £320 + VAT (micro) up to £600 + VAT (large) | Quoted, based on size and complexity |
| Who it suits | Most small businesses, and most tender requirements | Higher-risk work, larger contracts, government supply chains |
| Renewal | Every 12 months | Every 12 months, with Cyber Essentials held first |
| What it proves | The five controls are in place | The five controls are in place and have been tested |
What this looks like locally
We take businesses through Cyber Essentials across Denton (M34), Ashton-under-Lyne (OL6), Stockport (SK1) and Trafford (M33), including healthcare providers, accountancy practices, law firms and manufacturers. The pattern rarely changes. Most of the work is already done, and two or three small gaps stand between the business and a pass. Since April, those gaps are nearly always MFA on a cloud service someone forgot was there.
Frequently asked
What is Cyber Essentials?
A UK government-backed certification, run by the NCSC and delivered by IASME, showing that an organisation has five basic security controls in place to protect against common cyber attacks.
How much does Cyber Essentials cost?
Pricing depends on organisation size. It runs from £320 plus VAT for micro organisations with up to nine staff to £600 plus VAT for organisations with 250 or more. Cyber Essentials Plus is quoted separately.
What changed in April 2026?
New assessments from 27 April 2026 use the Danzell question set and version 3.3 of the requirements. Cloud services can’t be excluded, available MFA must be enabled for every user, and critical updates must be applied within 14 days.
Can we fail on just one thing?
Yes. Some questions are automatic fails, including MFA being switched off on a cloud service that offers it, and missing security updates on operating systems or applications.
How long does it last?
Twelve months. After that you renew against whichever version of the requirements is current at the time.
Do we need Cyber Essentials Plus?
Only if a client, contract or insurer asks for it, or if your work carries higher risk. Most small businesses start with Cyber Essentials, and you need that first anyway.
“Cyber Essentials isn’t a gold medal. It’s a seatbelt, and the certificate just proves you were wearing it.” — Brett Casterton, Inology IT
Pass first time, without the jargon.
I’m Brett at Inology IT. We’ll check your setup against the April 2026 requirements, fix the gaps that would cause an automatic fail, and take you through certification without the jargon. Drop your details below and I’ll come back to you the same day.
Last reviewed by Brett Casterton, October 2026.