Cyber Essentials

Cyber Essentials is a UK government-backed certification scheme designed to help organisations defend against the most common cyber attacks. Developed by the National Cyber Security Centre (NCSC) and administered by IASME, it requires organisations to demonstrate that five key technical controls are in place – firewalls, secure configuration, user access control, malware protection and patch management. Certification is achieved through a self-assessment questionnaire reviewed by an IASME-approved assessor.

Cyber Essentials is a self-assessed certification – you answer a questionnaire about your IT controls and an IASME-approved assessor reviews your responses. Cyber Essentials Plus goes further with an independent technical audit of your systems, conducted by a certified assessor, to verify that the controls you have declared are actually in place. Cyber Essentials Plus is required for higher-risk government contracts and is increasingly requested by enterprise clients and supply chain partners as evidence of genuine security implementation rather than self-declaration.

The Danzell update introduced more rigorous requirements across three main areas: cloud security (cloud services used by in-scope devices are now explicitly in scope), authentication (multi-factor authentication is now required for all cloud and remote access accounts) and patching (more stringent timelines for applying security updates). If you were certified before April 2026, your renewal will be assessed against the new Danzell standard. CyberLab’s pre-assessment service can help you identify any gaps before you submit. Read our full Danzell update guide →

Achieving Cyber Essentials certification protects your organisation against approximately 80% of common cyber attacks. It demonstrates your commitment to cyber security to customers, clients and stakeholders – improving your reputation and increasing your chances of winning new business. It enables you to bid for UK government contracts that require the certification, and for eligible organisations with a turnover below £20 million, it includes Cyber Liability Insurance worth up to £25,000. It also provides peace of mind that your systems and applications are secured against the most frequently exploited vulnerabilities.

Cyber Essentials certifications start from £320 – aligned with IASME’s recommended pricing. The final cost can vary depending on the size of your organisation and the level of support you need. CyberLab offers the certification by itself, alongside an optional pre-assessment check, or with additional remote consultancy support from our team. We are transparent about our pricing throughout – speak with our team for a quote based on your specific requirements.

Once you have completed the self-assessment questionnaire on the online portal, CyberLab aims to turn around all assessments within 24 hours. The time it takes to prepare for and complete the questionnaire depends on your current security posture and the size of your organisation – our pre-assessment service can help you work through the requirements efficiently and reduce the time to certification.

Yes, in many cases. The Cabinet Office requires Cyber Essentials certification for any supplier handling personal data of citizens or government employees, handling ICT systems that store or process data at the OFFICIAL classification level, or providing certain IT products and services under government contracts. Since 2014, Cyber Essentials has been a baseline requirement for government contracts involving personal information or sensitive IT services. Check your specific contract requirements or speak with our team if you are unsure whether certification is required.

Yes. Certain answers will result in an automatic fail regardless of other responses. The most common include: using unsupported operating systems or software that no longer receives security patches; having no firewall or boundary control in place; having no malware protection on end-user devices; using unchanged default passwords on routers, firewalls or other devices; and not having multi-factor authentication enabled for cloud and remote access accounts. If you are unsure whether your current setup meets the requirements, CyberLab can conduct a pre-assessment check before you submit.

The questionnaire requires answers to all questions – most require brief notes to help the assessor understand your organisation and the security controls you have in place. Providing full details upfront reduces the time required for certification as it minimises the need for follow-up questions. CyberLab’s assessors are available to clarify any questions during the process.

Yes. You can download the Cyber Essentials question set here to review the requirements before starting your assessment. This is a useful starting point for identifying any gaps in your current controls before you begin the formal process.

You need to be compliant across nearly all questions to pass. The pass criteria are set by the UK Government and are deliberately strict – you must demonstrate that all five technical controls are in place across your in-scope systems. If you are not compliant on certain questions, we recommend reviewing your processes to meet the requirement and adding explanatory notes where relevant. CyberLab’s pre-assessment service is designed to help you identify and address any gaps before you submit your formal assessment.

Eligible organisations with a turnover below £20 million receive Cyber Liability Insurance automatically upon certification. The cover includes a 24-hour helpline to report a cyber incident, crisis management and incident response support, up to a total liability limit of £25,000. For certifications issued after 1 October 2023, the cover is underwritten by American International Group UK Limited and administered by Sutcliffe & Co Insurance Brokers. Full terms and conditions are available on the IASME website.

CyberLab will contact you ahead of your expiry date with the steps required to complete your annual renewal. Cyber Essentials certification is valid for 12 months – renewal is required annually to maintain your certified status and keep your Cyber Liability Insurance active.