Cyber Essentials is a UK government-backed certification scheme designed to help organisations of all sizes protect themselves against the most common cyber threats. Introduced by the National Cyber Security Centre, the scheme sets out five core security controls that, when properly implemented, can prevent the vast majority of commodity cyber attacks targeting UK businesses.

For organisations looking to demonstrate their security credentials to customers, win public sector contracts, or meet the requirements of their cyber insurance policy, Cyber Essentials certification has become a baseline expectation rather than an optional extra. Since April 2026, the scheme’s requirements have been updated under version 3.3, bringing tighter enforcement around multi-factor authentication and cloud service coverage.

Why does Cyber Essentials matter for UK businesses?

Cyber attacks on UK businesses are not slowing down. According to the UK government’s Cyber Security Breaches Survey 2026, around 43% of businesses reported experiencing a cyber breach or attack in the past 12 months. The majority of successful attacks exploit basic security weaknesses that Cyber Essentials certification directly addresses.

Beyond the security benefits, there are several practical reasons why Cyber Essentials certification matters:

Government contracts. Certification is mandatory for any organisation bidding for central government contracts that involve handling sensitive information or personal data. Without it, those opportunities are closed off entirely.

Supply chain requirements. Enterprise clients and larger organisations increasingly require their suppliers and partners to hold Cyber Essentials certification as a condition of doing business. Certification signals that your organisation takes security seriously and has the controls in place to protect shared data.

Cyber insurance. Many insurers now reference Cyber Essentials as a condition of cover or as a factor in setting premiums. Certification can reduce your insurance costs and in some cases determines whether cover is available at all.

Customer confidence. Displaying Cyber Essentials certification demonstrates to clients, prospects, and stakeholders that your organisation has met a government-verified security standard. For sectors handling sensitive data, including legal, financial services, and healthcare, this is increasingly a differentiating factor in buying decisions.

NCSC research indicates that the five controls required for Cyber Essentials can prevent around 80% of the most common cyber attacks. For most organisations, achieving certification represents the single most cost-effective security investment available.

The two levels of Cyber Essentials certification

There are two levels of Cyber Essentials certification, each with a different assessment process and a different level of assurance.

Cyber Essentials

The entry-level certification involves a self-assessment questionnaire examining your organisation’s security policies and controls against the five core requirements. The assessment is reviewed and verified by a certification body. Cyber Essentials is suitable for most small and medium-sized businesses and provides a solid baseline of security assurance.

Cyber Essentials Plus

Cyber Essentials Plus includes everything covered in the standard Cyber Essentials certification and adds a hands-on technical verification carried out by an independent assessor. Rather than relying solely on your self-assessment, the assessor tests that your controls are actually working in practice by scanning your systems, testing your devices, and verifying your configurations against the scheme requirements. Cyber Essentials Plus provides a higher level of assurance and is required for organisations bidding for certain government contracts involving particularly sensitive information.

The five core Cyber Essentials controls

Cyber Essentials certification requires organisations to implement and demonstrate five core security controls. These controls address the most common attack vectors and together provide a meaningful baseline of protection.

1. Firewalls
A firewall controls the traffic entering and leaving your network. Cyber Essentials requires that a properly configured firewall is in place to protect all devices connected to the internet, including those used for home working. Under v3.3, cloud services used by your organisation are included in scope.

2. Secure configuration
Devices and software must be configured securely before being deployed. This means removing or disabling unnecessary features, changing default passwords, and ensuring that only the software and services your organisation needs are installed and active.

3. User access control
Access to systems and data must be controlled and limited to what each user genuinely needs to do their job. Under v3.3, each user must have a unique account with role-appropriate access rights. Shared or generic accounts are no longer acceptable.

4. Malware protection
Organisations must have appropriate malware protection in place, including anti-virus software, application controls, or both, depending on the type of device and operating system in use.

5. Patch management
All software and operating systems in scope must be kept up to date. Critical security patches must be applied within 14 days of release, and any software that is no longer supported by its vendor must be removed or isolated from the network.

Frequently asked questions about Cyber Essentials

What is Cyber Essentials certification?
Cyber Essentials is a UK government-backed certification scheme that verifies your organisation has five core security controls in place to protect against the most common cyber threats. It is administered by the National Cyber Security Centre and assessed by approved certification bodies.

What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials involves a self-assessment questionnaire reviewed by a certification body. Cyber Essentials Plus includes everything in the standard certification plus a hands-on technical verification carried out by an independent assessor, who tests that your controls are actually working in practice rather than simply documented in policy.

Is Cyber Essentials mandatory?
Cyber Essentials is mandatory for organisations bidding for central government contracts that involve handling sensitive information or personal data. It is not legally required for all businesses, but is increasingly expected by enterprise clients, insurers, and supply chain partners.

How long does Cyber Essentials certification last?
Cyber Essentials certification is valid for 12 months. Organisations must renew annually to maintain their certified status.

How long does it take to get Cyber Essentials certified?
Timelines vary depending on your current security posture and how much remediation is required before assessment. Organisations with most controls already in place can typically achieve certification within a few weeks. Those with more gaps to address may need longer. Arc recommends allowing at least eight to twelve weeks from initial gap analysis to certification.

Does Cyber Essentials cover cloud services?
Yes. Following the v3.3 update in April 2026, all cloud services your organisation uses are fully in scope for Cyber Essentials assessment. This includes email, Microsoft 365, collaboration tools, SaaS applications, and any other cloud-hosted service your team uses to access business data.

Can Arc help us get Cyber Essentials certified?
Yes. Arc is a Cyber Essentials Plus-certified provider and supports businesses through the full certification process, from initial gap analysis and remediation through to assessment and certification. Get in touch to discuss your requirements.

What happens if we fail Cyber Essentials?
If your organisation fails the assessment, you will receive a report detailing which controls were not met. You can then remediate the identified gaps and resubmit. Arc can support you through the remediation process to ensure the issues are properly addressed before resubmission.

Do we need Cyber Essentials Plus or will standard Cyber Essentials do?
For most businesses, standard Cyber Essentials provides a sufficient level of assurance and meets the requirements of most supply chain and insurance obligations. Cyber Essentials Plus is required for certain government contracts and provides a higher level of independent assurance that your controls are genuinely working. Arc can advise on which level is appropriate for your organisation based on your specific requirements.

Find out more about the scheme by visiting the National Cyber Security Centre.

Find out how to protect your organisation against cyber security threats and cyber attacks.

Learn more about cyber threats and why it is essential for businesses to provide IT security training for staff.