In short
Cyber Essentials certification, often called Cyber Essentials accreditation, shows that an organisation has the five technical controls of the UK government-backed scheme in place, confirmed by a verified self-assessment or, for Cyber Essentials Plus, hands-on testing. Forever Systems reviews your devices, cloud services and accounts against the five technical controls, fixes the gaps, then supports you through assessment with an IASME-licensed Certification Body, which issues the certificate.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What Cyber Essentials certification is
Cyber Essentials is a certification scheme developed by the National Cyber Security Centre (NCSC), the UK's technical authority for cyber security and part of GCHQ. The NCSC describes it as the minimum standard of cyber security recommended by the government for organisations of all sizes. IASME, the NCSC's Cyber Essentials Delivery Partner, runs registration and certification and licenses the Certification Bodies whose assessors mark applications. The UK Cyber Essentials scheme launched in 2014 and suits organisations of every size, from sole traders to large enterprises.
Certification asks one question: are five basic technical controls in place across the IT you use for work? Those controls are designed to protect against the routine, untargeted attacks that catch out many organisations: phishing, password guessing and the exploitation of software that has not been patched. Being Cyber Essentials certified shows customers, buyers and insurers that you have them in place, and the certificate is renewed every year.
There are two levels:
- Cyber Essentials self-assessment, often called Cyber Essentials basic. You answer an online question set, a director signs it off, and an assessor marks it.
- Cyber Essentials Plus, the same controls with hands-on technical testing of your systems by an assessor.
New to the scheme? Start with what is Cyber Essentials?, then compare the levels on Cyber Essentials vs Cyber Essentials Plus. When you are ready, our guide to how to get Cyber Essentials certification walks through each step.
Why organisations get Cyber Essentials certified
The NCSC notes that a growing number of organisations require suppliers to be certified before they can bid for work. The main reasons organisations certify are:
- Government contracts. Under PPN 014, central government departments, their executive agencies, non-departmental public bodies and NHS bodies ask suppliers on in-scope contracts to show Cyber Essentials or Cyber Essentials Plus (or equivalent controls) before award, and to renew it every year of the contract.
- Supply chains. Many larger buyers now ask suppliers for a certificate as standard. See Cyber Essentials for supply chain assurance.
- Sector requirements. Defence suppliers need it as the first step of Defence Cyber Certification, legal aid contracts starting from 1 October 2025 require it or an equivalent standard (law firms), and it is a requirement for colleges (schools and colleges).
- Lower risk. The five controls are designed to protect against the most common, untargeted internet-based attacks.
- Included insurance. IASME arranges cyber liability insurance, including a 24-hour incident response helpline, for organisations domiciled in the UK or Crown Dependencies with turnover under 20 million pounds that certify their whole organisation and opt in. See Cyber Essentials insurance for who qualifies, and Cyber Essentials certification cost for the fees.
The five technical controls
Every assessment, at both levels, is judged against the NCSC's *Cyber Essentials: Requirements for IT Infrastructure*, currently version 3.3 (in force from 27 April 2026). The requirements hub explains each control in depth.
| Control | What it means in practice |
|---|---|
| Firewalls | A properly configured firewall between every in-scope device and the internet, default admin passwords changed, inbound traffic blocked unless documented and approved |
| Secure Configuration | Unneeded accounts and software removed, auto-run off, devices locked and protected against password guessing |
| Security Update Management | Only licensed, supported software; critical and high-risk updates installed within 14 days |
| User Access Control | Unique accounts, least privilege, separate admin accounts and MFA on every cloud service |
| Malware Protection | Anti-malware or application allow listing active on every in-scope device |
Getting the scope right matters as much as the controls: cloud services cannot be excluded, and home-working and user-owned devices that access work data are usually in scope.
Not sure which level fits? Ask us
Tell us what you need and we will help you choose the right level.
What changed in 2026: the Danzell question set
Assessment accounts opened from 27 April 2026 answer the Danzell question set, which goes with Requirements v3.3. Marking is stricter than before:
- A cloud service without MFA, where the service offers it (free, included or paid), is an automatic fail of the whole assessment.
- Not installing critical or high-risk updates within 14 days, for operating systems, router and firewall firmware, or applications, is now an automatic fail.
- Unsupported software in scope remains an automatic fail, which matters for anyone still running Windows 10 without Extended Security Updates.
- Every in-scope legal entity must be listed, and the director's declaration now covers staying compliant for the whole certification period.
Our guide to common Cyber Essentials failures covers the rest of the usual traps.
Cyber Essentials consultancy, support and services from Forever Systems
Forever Systems is an IT and cyber security provider and part of Forever Group, whose wider cyber security services go beyond Cyber Essentials. Our Cyber Essentials consultancy and support prepares you for certification, and we work alongside an IASME-licensed Cyber Essentials certification body, whose assessor marks your submission and which then issues your certificate.
The questions can be hard to answer without a technical IT background or with a complex company structure, and IASME itself points applicants towards expert help for that reason. Our Cyber Essentials preparation services combine practical IT advice with hands-on work:
- Gap analysis. We check your devices, software support status, cloud tenants, MFA coverage, firewalls, admin accounts and malware protection against the current question set.
- Remediation. We can help fix what we find: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune.
- Assessment support. We help you define scope, answer the question set accurately and respond to any assessor queries.
- Cyber Essentials Plus rehearsal. We can run the same kinds of checks the assessor will run, before the Plus audit.
- All-year compliance. Managed updates and regular reviews help keep you compliant, so renewal is more straightforward.
Whether you want a consultant to take the lead or just some help with the trickier questions, we fit the support to your starting point, and pricing is confirmed at quote. Staff training is not one of the five controls, but it helps people avoid the phishing and password mistakes the controls are designed to contain. Our sister site covers Cyber Essentials staff training.
Contact us to find out how close you are to passing.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Cyber Essentials accreditation, certification bodies and assessors
Cyber Essentials accreditation is the common name for certification, and organisations that hold the certificate often describe themselves as "Cyber Essentials accredited". Strictly, organisations are certified: a Certification Body licensed by IASME assesses you and issues a certificate that is valid for 12 months.
- Certification Bodies are licensed by IASME. The NCSC says IASME manages a network of more than 400 cyber security organisations across the UK that can advise you and help you get certified.
- Assessors work for a Certification Body. IASME says they are trained and licensed by IASME to assess whether an organisation meets the requirements, and can issue the certification.
- Consultants and IT providers, such as Forever Systems, prepare you: they review your IT, fix gaps and help you answer accurately before the assessor sees your submission.
You can register through IASME directly (the self-led route) or through a Certification Body (the supported route); the requirements are the same either way. Our guide to choosing a Cyber Essentials certification body explains what to ask. To confirm that a supplier, or your own organisation, holds a current certificate, use the Cyber Essentials checker.
Find the guide you need
- Cyber Essentials requirements: the five controls, scope, cloud services, MFA and passwords
- Cyber Essentials self-assessment: how the basic certification works, and the Cyber Essentials questionnaire it uses
- Cyber Essentials Plus: the five test cases and how the audit runs
- Cyber Essentials requirements checklist: a quick self-check before you apply
- How to get Cyber Essentials certification, step by step, and Cyber Essentials certification cost
- Is Cyber Essentials certification free? What funded support and free help is available now
- Cyber Essentials insurance: the cyber liability cover included for eligible organisations
- Supply chain and government requirements, including PPN 014, defence and the NHS
- Sector guides for small businesses, charities, schools, law firms and MSPs
- UK cyber security frameworks: where Cyber Essentials fits alongside ISO 27001, the CAF and IASME Cyber Assurance
Cyber Essentials guides by topic
How Forever Systems helps you get certified
Common reasons for failing Cyber Essentials include unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We look for those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is not a last-minute scramble
Forever Systems is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
What is Cyber Essentials accreditation?
It is a common name for Cyber Essentials certification. Strictly, organisations are certified, not accredited: a Certification Body licensed by IASME assesses you and issues a certificate, which is valid for 12 months. The same applies to Cyber Essentials Plus.
Do I need a Cyber Essentials consultant?
Not necessarily. On the self-led route you register with IASME and answer the question set yourself, using IASME's free question set booklet, Readiness Tool and Knowledge Hub. A consultant or IT provider is useful when you have no in-house IT, a complex structure, or gaps to fix first, such as unsupported devices or cloud services without MFA. Small and medium-sized organisations can also book a free 30-minute consultation with an NCSC-assured Cyber Advisor through IASME.
What do Cyber Essentials support services include?
Ours include a gap analysis against the current question set, fixing what it finds, help agreeing a scope and drafting accurate answers, support with assessor queries, a rehearsal before any Cyber Essentials Plus audit, and help staying compliant until renewal. The assessment itself is carried out by an IASME-licensed Certification Body. Pricing depends on your size and starting point, so ask us for a quote.
Who carries out Cyber Essentials certification?
Certification Bodies licensed by IASME, the NCSC's Cyber Essentials Delivery Partner. Their assessors mark your answers or test your systems, and the Certification Body issues the certificate. Forever Systems prepares you, fixes the gaps and supports you through assessment alongside a licensed Certification Body.
What are the Cyber Essentials certification levels?
There are two. Cyber Essentials, sometimes called basic certification, is a verified self-assessment marked by an assessor. Cyber Essentials Plus uses the same five controls and adds hands-on technical testing of a sample of your devices and accounts, completed within three months of the Cyber Essentials certificate.
Is Cyber Essentials mandatory?
There is no general legal duty to hold it, but it is required for many contracts. Central government and NHS buyers apply it to in-scope contracts under PPN 014 (which also accepts equivalent controls), defence suppliers need it for Defence Cyber Certification, current legal aid contracts require it or an equivalent standard, and colleges must hold it under their funding agreement. Many private-sector buyers also ask suppliers for it.
How long does it take to get Cyber Essentials?
If your IT already meets the controls, IASME says that with answers prepared in advance the question set might take an hour or two, and that an assessor reviews your answers within three working days. Most of the elapsed time usually goes on fixing gaps, such as replacing unsupported devices or switching on MFA. You have six months from opening an assessment account to complete it.
Can I get Cyber Essentials for free?
The assessment fee is payable, but there is plenty of free help, including IASME's Readiness Tool, the free question set booklet and the NCSC Cyber Action Toolkit. The NCSC's Funded Cyber Essentials Programme ran for three years and the NCSC now lists it as closed. See our funded Cyber Essentials page for details.
Still have a question about Cyber Essentials certification support?
Ask us and a member of our team will reply by email.