Guide
Cyber Essentials for government suppliers in the UK
What the UK's Cyber Essentials and Cyber Essentials Plus schemes require, when central government contracts need them, and how small IT firms get certified.
If you want to sell IT services to the UK public sector, Cyber Essentials is usually the first certification to get. It's quick, inexpensive compared with other schemes, and often required.
The five controls
Cyber Essentials checks that you have these basics in place across the devices, cloud services and networks in scope:
- Firewalls: securing your internet connection.
- Secure configuration: removing default passwords and unnecessary software.
- User access control: giving people only the access they need, with multi-factor authentication for cloud services.
- Malware protection: anti-malware or application allow-listing.
- Security update management: applying critical and high-risk updates within 14 days.
Cyber Essentials vs Cyber Essentials Plus
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's checked | Self-assessment questionnaire, verified by a certification body | Same, plus a hands-on technical audit of your systems |
| Effort | Days to a few weeks | A few weeks, after the basic level |
| Renewal | Every 12 months | Every 12 months |
When it's required
UK central government requires Cyber Essentials for many contracts involving the handling of personal information or the supply of certain ICT products and services. The Ministry of Defence and some other buyers often require Cyber Essentials Plus. Many local councils, NHS bodies and universities ask for it too, and it often appears as a mandatory requirement in G-Cloud and other framework tenders.
How to get certified
- Read the current requirements document from the National Cyber Security Centre (NCSC).
- Decide your scope, ideally the whole organization.
- Fix any gaps, especially multi-factor authentication, unsupported software and patching.
- Complete the online assessment with a certification body licensed by IASME, the scheme's delivery partner.
- For Plus, book the technical audit within the required time after the basic certificate.
Common questions
Is Cyber Essentials mandatory for UK government contracts?
For many central government contracts that involve personal data or certain ICT services, yes. Check each tender.
Does Cyber Essentials replace ISO 27001?
No. It's a baseline of technical controls, while ISO 27001 is a full security management system. Many UK buyers ask for Cyber Essentials, and some ask for both.
Can firms outside the UK get Cyber Essentials?
Yes. Non-UK firms can be certified, which helps if you plan to bid for UK public contracts.