How to get Cyber Essentials and Cyber Essentials Plus – the ultimate UK guide [updated May 2026]
Here’s our ultimate guide to Cyber Essentials, what it is, why you should want it and how you get it. First, we’ll give an overview of the scheme, its purpose and value, then we’ll run through the 5 areas Cyber Essentials covers so you get a much clearer grasp of what’s involved.
So what is Cyber Essentials?
Cyber Essentials is a great first step towards making your systems more secure. It also helps you prove to suppliers that you are taking cyber security seriously.
Cyber Essentials certifications are suitable for organisations of all sizes. They are backed by the government and supported by The National Cyber Security Centre and the Information Commissioner.
Over time, the scheme has evolved to place greater emphasis on ongoing cyber hygiene and consistent security controls across your organisation, particularly within Cyber Essentials Plus assessments.
The governing bodies for Cyber Essentials have recently introduced significant changes that will affect how organisations achieve certification from 27th April 2026. In many cases, these updates will make the standard harder to achieve, requiring a more robust approach to compliance.
Cyber Essentials (CE) is currently undergoing its most significant period of flux since its inception. With the introduction of the latest standards by IASME and the NCSC, the certification process has become considerably more demanding. The “Verified Self-Assessment” (VSA) is no longer a simple tick-box exercise; it is now a rigorous technical declaration with zero margin for error.
You can read more on these blog posts:
- Critical changes to Cyber Essentials Plus – action may be required to avoid future certification risk
- Important: Changes to Cyber Essentials Certification & how we support you
Why should you want Cyber Essentials?
Cyber Essentials helps you guard against 80% of the most common forms of cyber-attacks and includes automatic cyber liability insurance.
It is increasingly required if you want to provide services to large clients so they can be sure you aren’t a weak link in their supply chain.
What about Cyber Essentials Plus?
Cyber Essentials Plus builds on the standard Cyber Essentials certification by introducing independent technical verification of the controls within your environment.
Rather than relying solely on a self-assessment questionnaire, Cyber Essentials Plus includes device sampling, vulnerability testing and verification of key controls such as patching, malware protection and multi-factor authentication.
This provides significantly greater assurance to clients, suppliers and partners, which is why Cyber Essentials Plus is increasingly required within government supply chains and larger organisations.
Recent updates to the scheme have also increased the importance of ongoing patching compliance and consistent security controls across the environment, making preparation and operational visibility more important than ever.
Cyber Essentials is designed to be achievable
One of the strengths of Cyber Essentials is that it focuses on practical, widely recognised security controls rather than complex enterprise compliance frameworks.
For many organisations, the standard Cyber Essentials certification remains a very achievable first step towards improving cyber resilience.
However, as the scheme has evolved, particularly within Cyber Essentials Plus, there is now greater emphasis on demonstrating that these controls are applied consistently across the organisation and maintained over time.
That means preparation, visibility and ongoing patch management are becoming increasingly important parts of the process.
What’s changed in Cyber Essentials Plus since April 2026 with the introduction of Danzell?
Upcoming changes to Cyber Essentials Plus are expected to make the assessment process more rigorous for many organisations.
The updated approach places greater emphasis on areas such as patching compliance, multi-factor authentication and consistent security controls across the entire in-scope environment. In practice, this means organisations are likely to need better visibility of devices, stronger patch management processes and greater confidence that controls are being maintained throughout the year, not just at the point of assessment.
For some organisations, this will make Cyber Essentials Plus more demanding than it has been previously, particularly where remote devices, hybrid working or complex estates are involved.
That may create additional operational pressure, but the intention behind the changes is to ensure the certification continues to represent a meaningful baseline of cyber security, rather than simply a point-in-time exercise.
As a result, many organisations are now placing greater focus on ongoing readiness, vulnerability visibility and pre-assessment verification ahead of renewal.
How do you achieve Cyber Essentials?
Cyber Essentials consists of a simple self-assessment questionnaire that asks you about what you have in place to protect your business from cyber threats. It covers 5 specific ‘controls’ that have been produced by the government and industry bodies.
To understand these better, let’s run through them.
The 5 controls of Cyber Essentials
1) Keep your devices and software up-to-date
Ensuring that all your devices’ operating systems and applications are up-to-date is very important, because manufacturers and developers regularly release patches to address security vulnerabilities that have been discovered. Cyber Essentials will enable you to identify if you are running unsupported software, and if your supported applications / operating systems are up-to-date.
2) Protect yourself from viruses and other malware
Protecting your systems with anti-virus software, intrusion detection/prevention systems would be akin to having CCTV or a security guard at your entrance, alerting you to potential threats and even stopping them on your behalf. Most popular operating systems include effective virus and threat protection… if all the modules are enabled. How is your configuration?
3) Control who has access to your data and services
Would you let everyone you know have a key to your home? No way! Cyber Essentials helps you take control of who has access to your data and services. Often clients don’t understand the significance of administrator and standard user accounts, and yet getting this wrong could result in an intruder having access to far more than you’d like.
4) Use secure settings for your devices and software
Most devices and software applications are supplied with default configurations that make getting started easy for the user. However, as above, leaving default settings can make it easier for cyber attackers to gain access to your data. Sharing user accounts and login credentials and having weak passwords also represents a significant risk.
5) Use a firewall to secure your internet connection
Do you have a firewall? Of course, you do! A larger organisation may have a bespoke firewall device, a smaller company or home worker will have a software firewall built into the hub or router provided by their ISP. But have you changed the default password on your firewall/router? No?
How do you achieve Cyber Essentials Plus?
To achieve Cyber Essentials Plus, your organisation must first achieve the standard Cyber Essentials certification. Once this has been completed, a certification body such as Securious carries out an independent technical assessment to verify that the controls declared in the self-assessment are operating effectively in practice.
The assessment typically includes:
- Device sampling across the agreed scope
- Vulnerability scanning
- Checks for missing security updates
- Malware protection verification
- Multi-factor authentication testing
- User account and access control checks
The exact scope and assessment approach will vary depending on the size and complexity of your environment, including factors such as remote working, cloud services and the number of devices in scope.
Unlike the standard Cyber Essentials certification, Cyber Essentials Plus is not simply a questionnaire exercise. It is designed to provide independent assurance that key security controls are properly implemented and maintained across the organisation.
As the scheme evolves, preparation and ongoing visibility are becoming increasingly important, particularly around patching compliance and endpoint management. Many organisations now choose to undertake a pre-assessment review or ongoing vulnerability scanning ahead of renewal to reduce the risk of issues arising during the live assessment process.
How much does Cyber Essentials cost?
The cost of the certification scheme is limited by the Government and starts at just £320 (+ vat). The cost of Cyber Essentials Plus is from £2,200 (+ vat).
How Securious can help with Cyber Essentials and Cyber Essentials Plus
How Securious can help with Cyber Essentials
At Securious, we support organisations at every stage of the Cyber Essentials and Cyber Essentials Plus process, from first-time certification through to ongoing compliance and renewal readiness.
Whether you simply need certification, want additional guidance through the assessment process, or require greater assurance ahead of Cyber Essentials Plus renewal, we offer a range of services designed to match the level of support your organisation needs.
Cyber Essentials
Our standard Cyber Essentials certification service is designed for organisations with dedicated technical or compliance resource that are confident interpreting and meeting the requirements without additional support.
Learn more about our Cyber Essentials service
Cyber Essentials Assisted
For organisations that would prefer expert guidance throughout the process, our Cyber Essentials Assisted service provides hands-on support from our team to help interpret the requirements, avoid common pitfalls and ensure the assessment is completed correctly first time.
This is now the recommended route for many organisations, particularly as the scheme has become more rigorous in recent years.
Learn more about our Cyber Essentials Assisted service
Cyber Essentials Plus
We provide full Cyber Essentials Plus assessments, including independent technical verification of the controls within your environment. This includes device sampling, vulnerability testing and verification of key security controls across the agreed scope.
Learn more about our Cyber Essentials Plus service
Cyber Essentials Plus Pre-Assessment Gap Analysis
Our Pre-Assessment Gap Analysis service mirrors the technical process of a live Cyber Essentials Plus assessment, allowing issues to be identified and addressed before entering the formal verification process.
This provides organisations with a much clearer understanding of likely certification readiness and helps reduce the risk of problems arising during assessment week.
Learn more about our Cyber Essentials Plus Pre-Assessment Gap Analysis service
Cyber Essentials Vulnerability Scanning Service
Our ongoing vulnerability scanning service provides continuous visibility of vulnerabilities, missing security updates and devices falling outside required remediation windows.
Designed to support organisations between Cyber Essentials Plus renewals, the service helps improve year-round visibility, strengthen patch management processes and reduce the likelihood of issues being identified during live assessments.
If you are unsure which route is right for your organisation, our team can help you understand the available options and recommend the most appropriate approach based on your environment, internal resource and certification goals.
Learn more about our Cyber Essentials Vulnerability Scanning Service
What should I do next?
Based at the Exeter Science Park, in Exeter, Devon, Securious is a Cyber Essentials Certification Body and has been helping businesses achieve Cyber Essentials certification since 2015. If you have any questions, send us an email to info@securious.co.uk
Read more cyber security guides:
SIEM solutions and SOCs: a UK guide for better cyber security and compliance