Key Facts
- Regulator
- National Cyber Security Centre (NCSC), which developed the scheme. IASME is the NCSC's official Cyber Essentials Delivery Partner and licenses the Certification Bodies that assess applicants.
- Latest version
- Cyber Essentials Requirements for IT Infrastructure v3.3 (v3.2 remains available for applications started before 27 April 2026)
- Effective
- 27 April 2026
- Official text
- www.ncsc.gov.uk ↗
What is Cyber Essentials?
The Cyber Essentials scheme is the UK Government-recommended minimum standard of cyber security, developed by the National Cyber Security Centre (NCSC) and delivered through IASME. It sets five technical controls that protect against the most common cyber attacks. It applies to organisations of all sizes, and becomes a contract requirement in some government procurement.
The current requirements document is Cyber Essentials Requirements for IT Infrastructure v3.3, effective from 27 April 2026. Version 3.2 remains available for applications started before that date. The NCSC overview is the official starting point.
There are two levels, and both assess the same five technical controls:
- Cyber Essentials is a verified self-assessment. Answers are signed off by a board member or equivalent, then marked by an assessor.
- Cyber Essentials Plus adds independent technical testing of the systems.
Certification is reached by one of two routes: self-led, or supported by a Certification Body licensed by IASME. IASME is the NCSC's official Cyber Essentials Delivery Partner and licenses the Certification Bodies that assess applicants.
Why it matters
The tender arrives with one pass/fail line: Cyber Essentials certificate required. You don't hold one, and the bid window is already open.
Three things make the scheme worth knowing before that happens:
- Government contracts. PPN 014 requires in-scope public bodies to ensure suppliers on certain higher-risk contracts meet the scheme's technical requirements. Where certification is required, the supplier renews it annually for the duration of the contract.
- Cyber Essentials insurance. Any UK organisation with a turnover under £20m that certifies its whole organisation is automatically entitled to Cyber Liability Insurance arranged by IASME.
- A shared baseline. The NCSC describes Cyber Essentials as the minimum standard of cyber security the Government recommends for organisations of all sizes. A buyer who sees the certificate knows what was assessed.
A certificate is only as good as its scope.
Who it applies to
Cyber Essentials is voluntary in general. Any organisation, of any size, can certify.
It becomes a contractual or procurement requirement where central government departments, their executive agencies, non-departmental public bodies and NHS bodies apply PPN 014 to higher-risk contracts. The supplier then needs certification, or must show equivalent controls.
Who should certify: suppliers to those bodies, and their subcontractors where the Model Services Contract security schedule applies. Who usually doesn't need to: a firm with no public-sector customers and no buyer asking for it, which faces no legal duty to certify.
The relationship to ISO 27001 is narrower than people assume. PPN 014 states that ISO 27001 holders will not automatically conform to Cyber Essentials, because the five technical controls are not usually all in scope for ISO 27001, and its audits are unlikely to test them. Cyber Essentials is the smaller, baseline scheme; our ISO 27001 guide covers the management system.
The UK position
Cyber Essentials is a UK scheme, and three UK regimes make it a commercial or contractual matter:
| Regime | Who it affects | What it asks for |
|---|---|---|
| PPN 014: Cyber Essentials scheme (Cabinet Office, updated February 2025) | Central government departments, executive agencies, non-departmental public bodies and NHS bodies, and their suppliers | Cyber Essentials or Cyber Essentials Plus, or equivalent controls, for certain higher-risk contracts; renewed annually for the contract's duration |
| Procurement Act 2023 (section 56, technical specifications) | In-scope buyers | Equivalents to certification must be accepted, so suppliers need only show they meet the requirements |
| Government Security Policy Framework and Model Services Contract | Suppliers and relevant subcontractors on contracts using the model terms | Security schedule requires Cyber Essentials or Cyber Essentials Plus, or equivalent |
For a UK firm of 25 to 250 people, the usual first encounter is a procurement document naming PPN 014, or a prime contractor passing the requirement down.
Key requirements
The NCSC groups the requirements under five technical controls:
- Firewalls filter traffic between the internet and your network.
- Secure configuration sets up computers and devices to cut the ways an attacker can get in.
- Security update management keeps software patched, so attackers can't use known flaws as a way in.
- User access control limits who can reach your data and services, and at what level.
- Malware protection finds and stops viruses and other malicious software before they cause harm.
Five controls are a floor, not a programme.
Scope in practice
Scope decides what the certificate means. Three rules apply:
- Legal entity by default. Certification applies to the legal entity providing the goods or services, not any wider corporate group. The scope can be restricted to part of that entity.
- Cloud services. Cloud services holding the organisation's data or services must be in scope, and v3.3 says plainly that they cannot be excluded. The applicant is always responsible for making sure every control is in place, even where the cloud provider runs some of them. The requirements document on the NCSC resources page sets out who does what for each type of cloud service.
- Third parties. Third-party security is not automatically in scope.
Frequently asked questions
You choose one of two routes. Self-led: register with IASME, pay, and complete the verified self-assessment, which a board member or equivalent signs off before an assessor marks it. Supported: hire a Certification Body licensed by IASME to help you understand the questions. Before either, the NCSC's free Cyber Essentials Readiness Tool gives tailored guidance on the five controls.
Both levels assess the same five technical controls. Cyber Essentials rests on a verified self-assessment that a board member signs off and an assessor marks. Cyber Essentials Plus adds independent technical testing to check that those controls work in practice. A buyer that names one level in a contract is choosing the assurance it wants, so check which one the tender asks for.
Not by law. Cyber Essentials becomes a requirement through contracts, mainly where public bodies apply PPN 014. Its higher-risk contracts include those where a supplier handles the personal information of citizens or government staff, or supplies ICT systems built to hold OFFICIAL data. PPN 014 adds that the certificate, or proof of equivalent controls, is essential by the time data passes to the supplier.
No. PPN 014 says most businesses with ISO 27001 will have to adopt Cyber Essentials as well, or show equivalent controls. The reason is scope: an ISO 27001 programme rarely includes all five Cyber Essentials controls, and its audits are unlikely to test them. An ISO 27001 holder should compare its ISMS scope with the Cyber Essentials boundary before a tender asks.
Cyber Essentials Requirements for IT Infrastructure v3.3 is current, effective from 27 April 2026; applications started before then can follow v3.2. Version 3.3 defines cloud services and states that they cannot be excluded from scope. It also extends passwordless authentication to include FIDO2, brings the Software Security Code of Practice into its software development section, and stresses backing up data.
Yes, for smaller firms. Any UK organisation with a turnover under £20m that certifies its whole organisation under Cyber Essentials is entitled to free Cyber Liability Insurance arranged by IASME. The cover includes a 24-hour helpline to report an incident, with crisis management and incident response up to a total liability limit of £25,000. Certifying only part of the organisation does not qualify.