United Kingdom

UK Cyber Essentials & Cyber Essentials Plus Readiness

Cyber Essentials is the UK government-backed baseline cybersecurity certification, overseen by the NCSC and delivered through IASME's certification-body network. Cyberox provides readiness assessment and remediation support ahead of self-assessment (Cyber Essentials) or independent technical verification (Cyber Essentials Plus).

Assess Your Cyber Essentials Readiness → Talk to an Expert

Last reviewed: September 2026. Verify current requirements against the official regulator before acting — sources linked below.

NCSC-backed

Owned by the National Cyber Security Centre

Technical control themes

Apr 2026

Latest scheme update

Self-Assessed / Independently Verified

Two certification tiers

Regulatory Landscape

What This Framework Requires

🏛️

Scheme Ownership

Cyber Essentials is a UK government-backed scheme launched in 2014 and owned by the National Cyber Security Centre (NCSC), with IASME acting as the NCSC's delivery partner managing the network of certification bodies and assessors since 2020.

✅

Cyber Essentials vs. Cyber Essentials Plus

Cyber Essentials is a self-assessed questionnaire verified by a certification body. Cyber Essentials Plus covers the same five control themes but requires an independent assessor to technically verify the controls are actually implemented and working on live systems — a materially higher bar.

🔑

April 2026 Scheme Update

The scheme's five core control themes remain unchanged, but the April 2026 update raises the minimum password length to 12 characters (from 8), places greater emphasis on passwordless authentication and MFA (including passkeys), and tightens requirements around cloud services, home working, thin clients and BYOD.

💼

Why Buyers Ask For It

Cyber Essentials is commonly required as a condition of UK government contracts and is increasingly requested by private-sector buyers and insurers as baseline evidence of cybersecurity hygiene — including from suppliers outside the UK bidding into UK supply chains.

🌍

Relevance Beyond the UK

Non-UK organizations selling into UK public-sector or enterprise supply chains, or seeking a fast, internationally recognized baseline certification alongside ISO 27001, often pursue Cyber Essentials specifically for that purpose.

⚠️

Verify Before You Commit

Confirm current scheme requirements, assessment-account timing (the April 2026 changes apply to assessment accounts created after that date) and certification-body process directly with IASME or the NCSC before starting.

How Cyberox Helps

Cyber Essentials Readiness Services

We assess your environment against all five control themes before you submit a self-assessment or book an independent Cyber Essentials Plus audit — so gaps are found by us, not by the assessor.

✓
Cyber Essentials Readiness Assessment — Gap assessment against all five technical control themes, including the April 2026 password and MFA changes.
✓
Cyber Essentials Plus Preparation — Technical remediation and mock-audit preparation ahead of independent verification of your live systems.
✓
Remediation Support — Hands-on support closing firewall, configuration, patching, access-control and malware-protection gaps.
✓
BYOD & Cloud Scoping — Guidance on scoping cloud services, home working and BYOD devices correctly under the current scheme requirements.
✓
ISO 27001 Alignment — For organizations pursuing both, Cyber Essentials' technical controls fit naturally within a broader ISO 27001 ISMS.

Assess Your Cyber Essentials Readiness

5 Control Themes

1Firewalls

2Secure Configuration

3Security Update Management

4User Access Control

5Malware Protection

April 2026 Update

12-character minimum passwords, stronger MFA/passkey emphasis, and tighter cloud/BYOD/home-working requirements.

FAQs

United Kingdom Compliance — Common Questions

What is the difference between Cyber Essentials and Cyber Essentials Plus?+

Cyber Essentials is a self-assessed questionnaire covering five technical control themes, verified by a certification body. Cyber Essentials Plus covers the same five themes but adds independent technical verification — an assessor actually checks the controls are implemented and working on your live systems, rather than relying on your own answers.

Who oversees the Cyber Essentials scheme?+

Cyber Essentials is a UK government-backed scheme owned by the National Cyber Security Centre (NCSC). IASME has acted as the NCSC's delivery partner since 2020, managing the network of licensed certification bodies and assessors.

What changed in the April 2026 Cyber Essentials update?+

The five core control themes stayed the same, but the update raised the minimum password length to 12 characters (up from 8), increased emphasis on passwordless authentication and MFA including passkeys, and tightened requirements for cloud services, home working, thin clients and BYOD. The changes apply to assessment accounts created after the scheme's April 2026 effective date.

Can a non-UK company get Cyber Essentials certified?+

Yes — Cyber Essentials is commonly pursued by non-UK organizations bidding into UK government or enterprise supply chains where certification is a contractual requirement or competitive differentiator. Confirm current certification-body processes for non-UK applicants with IASME.

Related Services & Frameworks

🏆

ISO 27001 Consulting

A broader ISMS certification that Cyber Essentials' technical controls fit naturally within.

Learn more →

⚡

Vulnerability Assessment

Technical testing that supports Cyber Essentials' secure-configuration and patch-management themes.

Learn more →

🇪🇺

GDPR, CRA & AI Act

Related EU/UK-adjacent regulatory obligations for organizations serving both markets.

Learn more →

Ready to Pursue Cyber Essentials Certification?

Get a readiness assessment against all five control themes before you submit a self-assessment or book a Cyber Essentials Plus audit.

Assess Your Cyber Essentials Readiness Talk to an Expert