Cyber Essentials is a UK government-backed scheme, run by the National Cyber Security Centre (NCSC) and delivered through certification bodies, that sets a baseline of technical security controls. It is designed for organisations of every size. Customers, funders and insurers increasingly ask for it, and some public sector contracts require it.
The five controls, in plain English
- Firewalls. Only the network services you need can be reached from the internet. On laptops and phones that move between networks, that usually means the built-in software firewall is switched on.
- Secure configuration. Devices and accounts are set up properly: unnecessary accounts and software are removed, default passwords are changed, and devices lock when left alone.
- Security update management. Software is licensed and still supported, and important security updates, the ones that fix critical or high-risk flaws, are applied within 14 days of release.
- User access control. Everyone has their own account, access is limited to what people need, leavers' accounts are removed or disabled, administrator accounts are kept separate from everyday ones, and a second sign-in step is used wherever one is available. For cloud services it must always be used.
- Malware protection. Every in-scope device has protection that is switched on and kept up to date, or only allows approved applications to run.
Notice what is not on the list: backups. Cyber Essentials does not require them, although the scheme strongly recommends them, and so would we.
Scope is where people are surprised
The certificate covers what you define as in scope, and the rules are broader than many expect.
- Cloud services such as email and file storage must be in scope. They cannot be left out.
- Personal devices are in scope if they are used to reach organisational data or services, with narrow exceptions such as devices used only for calls, texts and sign-in prompts.
- Devices used by people working from home are in scope by default.
- Accounts that suppliers or support providers use to manage your systems are in scope too.
- A scope that leaves out end-user devices is not acceptable.
For a family office or small charity with a mix of personal and office devices, working out the scope honestly is often the most useful part of the whole exercise.
Cyber Essentials and Cyber Essentials Plus
Both levels use the same technical requirements. The difference is how they are checked.
- Cyber Essentials is a self-assessment that is independently verified. You answer a detailed questionnaire, a senior person in the organisation signs it off, and an external assessor marks it.
- Cyber Essentials Plus starts with that same self-assessment and adds a technical audit. An assessor scans your internet-facing addresses, tests a selection of your devices, for example for updates, malware protection and account separation, and checks that second sign-in steps work on your cloud services. Problems found must be fixed before you can pass, and the audit has to take place within three months of the basic certificate.
Where organisations most often come unstuck
Two things come up more than any others. First, a second sign-in step is not switched on for every account that supports it. Second, security updates are not applied on time. Both are easy to miss in a mixed environment of personal and office devices and cloud accounts, and both are much easier to fix before an assessor finds them than after.
How long it takes and what it costs
The honest answer is that it varies a great deal. The certification body's fee for the basic certificate depends on the size of the organisation and is published by the body. The effort depends almost entirely on how well the basics are already in hand. An organisation with managed devices and a second sign-in step everywhere can be ready quickly, while one starting from personal accounts and unsupported devices has real work to do first. Cyber Essentials Plus adds the audit, so it costs more and takes longer. Certificates are renewed every year.
Is it worth it?
For most small organisations, yes, for two reasons. The certificate is something a bank, funder, insurer or larger customer can rely on without asking you to explain yourself. And the work of getting ready tends to fix the problems that actually cause incidents. It is not a guarantee that you will never be attacked, and a certificate is a snapshot rather than a promise, but it is a sensible, independently checked floor.
How we can help
Wolf Rock Tech Limited is itself Cyber Essentials certified (October 2026, whole organisation), so we have been through the process as a small organisation ourselves. We help organisations decide the scope, close the gaps, complete the assessment and, for Cyber Essentials Plus, prepare for the audit. If you would like a quick idea of where you stand first, our free Cyber Health Check covers many of the same basics in about three minutes. It is not a Cyber Essentials assessment, but it will show you the gaps worth closing first.
This guide follows the NCSC's Cyber Essentials requirements, version 3.3 (April 2026). See the NCSC Cyber Essentials overview for the scheme itself.