Cyber Essentials FAQs

It is a UK government-backed certification, overseen by the National Cyber Security Centre and delivered by IASME, that shows you have put five basic technical controls in place against common online attacks. It has two levels: Cyber Essentials, a verified self-assessment, and Cyber Essentials Plus, which adds a hands-on technical audit.

No. It is not a legal requirement for most businesses, but it is the government-recommended minimum standard, and customers, insurers and public-sector buyers increasingly ask to see it in tenders and supplier checks.

Any UK organisation of any size or sector, from sole traders to larger firms. The scheme is designed so that non-technical owners can follow it, and help is available if the questions feel daunting.

Firewalls, secure configuration, security update management, user access control and malware protection. Each one closes off a common route that everyday attackers use, and the assessment questions are grouped under these five headings.

One year. You renew it annually, so your protections are re-checked as your business, devices and software change.

IASME publishes its assessment fee by company size. At the time of writing it is 320 pounds plus VAT for 0 to 9 employees, 440 for 10 to 49, 500 for 50 to 249 and 600 for 250 or more. That is IASME’s fee for the assessment only. ABCOM’s guidance to get you through it is charged separately and quoted according to how complex your set-up is, and any upgrades your systems need are extra. We can give you a clear figure after a short call.

IASME says UK organisations with a turnover under 20 million pounds that put their whole organisation in scope are automatically eligible for included cyber liability insurance with a 25,000 pound limit, if they opt in.

You prepare your answers, register and pay, then complete the questions on the secure assessment platform. A senior board member confirms the answers are true, a qualified assessor marks them, and once you pass you receive your certificate.

If you have prepared your answers in advance, filling in the questions can take an hour or two. The assessor reviews your submission within about three working days, and resubmissions are reviewed in the same time. You have six months from registering to finish.

A senior member of the board or equivalent must agree a declaration that the answers are true. If you are a sole trader, that is you.

You can log back in to see the marking and feedback. You then have two working days to make the changes, update your answers and resubmit, so a first attempt that needs fixes is not the end of the road.

Yes. The question set and the Requirements for IT Infrastructure document are free to download from IASME. They are for preparation only, so you copy your answers into the online platform rather than submitting the file.

It depends on how comfortable you are with your IT. Some firms work through the free guidance and the readiness tool alone. Others use an NCSC Assured Service Provider such as ABCOM to find the gaps, fix them and prepare the answers, then have the assessment marked by a certification body.

Take our free Cyber Essentials readiness quiz. It mirrors the real questions, gives you a score, shows the three things to fix first and flags any automatic-fail risks, in about four minutes.

Scope is every part of your organisation and network that is covered by the certification. Describing it as the whole organisation means no network is excluded, which is the simplest option and the one that qualifies for the included insurance.

Yes. Any personally owned device that is used to access your organisation’s data or services, for example reading company email on a personal phone, is in scope and needs the controls applied.

Yes. Organisational services include cloud applications and subscriptions such as Microsoft 365 or Google Workspace, so the controls apply to them too. For Cyber Essentials Plus, multi-factor authentication is checked on every in-scope cloud service.

Home workers’ devices are in scope. If they use their own router or firewall, the key point is that the software firewall on each device is switched on. Where a device connects by 4G or 5G tethering, the device firewall is the network boundary.

No. Printers and switches are not deemed to be in scope, although the computers and servers that connect through them are.

Yes. Virtual machines and containers need the same controls as any other device, and every user device that connects to a virtual desktop is in scope.

Only by properly segregating it behind a firewall or VLAN, at network layer 2 or 3, with all inbound and outbound connections blocked at its boundary. Device-level firewall rules, a proxy server, user groups or micro-segmentation do not take devices out of scope.

Yes. Every third-party engineer must have unique credentials. Shared accounts do not meet the requirements.

No. Operating systems designed for penetration testing, such as Kali Linux or Parrot OS, cannot be part of a certification, and that includes virtual installations.

No. There are no location restrictions on Cyber Essentials, so the same rules apply wherever your network sits.

Cyber Essentials focuses on internet-connected IT rather than OT. Keep OT isolated through segmentation, monitoring and access control, and make sure any point where OT touches your IT, such as shared networks or remote access, meets the requirements.

For laptops, desktops, mobile devices and servers you list the make and the operating system.

Both use the same five controls and Plus begins with the verified self-assessment. Plus then adds a technical audit, carried out by a certification body, to prove the controls are really working on your systems.

Yes. The scope of Cyber Essentials Plus must be the same as your existing Cyber Essentials certificate.

Within three months of your most recent Cyber Essentials certification. You can request quotes through IASME or approach a certification body directly.

An external vulnerability scan of each public IP address in scope, plus testing of a representative sample of devices across each operating system. Auditors check that supported software is fully updated, that high and critical fixes are applied within 14 days, that malware protection or allow-listing is configured, that standard users cannot do administrator tasks, and that MFA protects all in-scope cloud services.

A high or critical vulnerability must be fixed and the system rescanned before a pass can be awarded. Every part of the audit must be passed, and a failed test fails the overall assessment, so it pays to fix gaps before the auditor arrives.