Security & governance
Cyber Essentials
Cyber Essentials is the UK government-backed certification scheme that sets a baseline of technical security controls for organizations of any size. Developed by the National Cyber Security Centre and delivered through its partner IASME, it certifies that an organization has five core controls in place against common internet-based attacks.
What are the five Cyber Essentials controls?
The scheme is deliberately narrow. It checks five technical controls and nothing else.
| Control | Aim |
|---|---|
| Firewalls | Only necessary network services are reachable from the internet |
| Secure configuration | Systems are set up to reduce vulnerabilities, with defaults changed |
| Security update management | Devices and software are kept patched |
| User access control | Accounts have only the access they need, with strong authentication |
| Malware protection | Malicious software is prevented from running |
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials combines self-assessment with independent review of the answers. Cyber Essentials Plus covers the same protections but adds more rigorous, independent technical testing of the organization's systems. The NCSC describes Cyber Essentials as the minimum standard recommended by the government, and a growing number of buyers require certified suppliers. The G-Cloud 15 framework, for example, includes an optional contract schedule on maintaining Cyber Essentials certification.
What changed in the April 2026 requirements?
Version 3.3 of the requirements applies to assessments opened after 27 April 2026. Cloud services now have a formal definition and cannot be excluded from scope. Multi-factor authentication is mandatory for every cloud service that offers it, and missing it is an automatic failure. The section on web applications was reframed as application development, the guidance on user access puts more weight on passwordless methods such as passkeys, and the guidance on backups was moved to the front of the document to stress its importance.
Does Cyber Essentials cover backups and storage?
Backup is not one of the five controls, so it is not assessed as such. The requirements document carries guidance recommending backups, and its move to a more prominent position signals that the scheme owners expect them. Storage and backup systems are still in scope as devices and services: their administrative interfaces need access control and multi-factor authentication, and their software needs timely updates. Organizations that need assurance on recovery itself look to broader frameworks and to their own disaster recovery testing.
Frequently asked questions
Who runs Cyber Essentials?
The National Cyber Security Centre developed the scheme. IASME is its official delivery partner and works with licensed certification bodies.
Are backups required for Cyber Essentials?
Backups are not one of the five assessed controls. The requirements include guidance that recommends them.
Is multi-factor authentication required?
Under version 3.3 it is mandatory for all cloud services where it is available, and failing to enable it fails the assessment.
Related terms
- NCSC: the UK authority behind the scheme.
- UK GDPR: the UK data protection regime.
- Third-party risk management: why buyers ask suppliers for certificates.
- IAM policy: controlling who can do what on a system.
- Disaster recovery testing: proving that recovery works.