What is Cyber Essentials (UK)?
Cyber Essentials is a government-backed scheme created to help organizations of all sizes protect themselves against a wide range of common cyber attacks. It was established to ensure a baseline level of cyber security is accessible and achievable for all.
There are two levels of Cyber Essentials certification:
- Cyber Essentials – This level involves a self-assessment aimed at protecting your organization from common cyber threats (which, if left unaddressed, can lead to more serious breaches). It walks you through the steps needed to secure your systems and prevent the most common attack vectors.
- Cyber Essentials Plus – This level includes the same five technical control themes as the standard certification, but adds an independent hands-on technical audit by a Certification Body. Both levels can be achieved simultaneously, or the “Plus” can be completed within 3 months of passing the basic Cyber Essentials certification. Small UK-based organizations that achieve Cyber Essentials Plus may also qualify for cyber insurance through IASME, the official delivery partner. More information here.
Cyber Essentials was developed by the UK Government in partnership with the Information Assurance for Small and Medium Enterprises (IASME) Consortium and the Information Security Forum (ISF). The scheme is overseen by the National Cyber Security Centre (NCSC) and delivered by IASME, who provide certification, guidance, and policy updates.
Certificates awarded by IASME are valid for 12 months and must be renewed annually.
Cyber Essentials has been updated regularly to reflect evolving threats and technologies. The latest version (v3.3 “Danzell”) came into effect on April 27, 2026 and replaced the previous v3.2 “Willow” question set. All assessments starting from that date must follow the updated v3.3 requirements. The Danzell update introduces refinements to scope definitions, system classifications, and control expectations to better align with modern IT environments, including cloud usage and identity-based access controls.
What are the requirements for Cyber Essentials (UK)?
The framework itself is built on compliance against 5 technical controls:
- Firewalls
- Secure Configuration
- User Access Control
- Malware Protection
- Security Update Management
Each of these main areas encompasses its own detailed objectives and requirements to apply to the scope of your assessment.
To achieve compliance, organizations must:
- Define the scope boundary for the assessment (updated in v3.3 to include clearer guidance on cloud services, remote environments, and user-owned devices where applicable)
- Review the five control themes and ensure full implementation
- Address all requirements and ensure continuous compliance across the in-scope environment
- Ensure accurate classification of devices, software, and users in line with updated definitions introduced in v3.3 (e.g., refined distinctions between unmanaged devices and corporate assets)
The most up-to-date technical specifications are outlined in IASME’s Requirements for IT Infrastructure document and the current question set associated with the certification (updated to the Danzell v3.3 question set effective April 2026, replacing Willow v3.2).
Why should you become Cyber Essentials (UK) compliant?
The primary aim of Cyber Essentials is to improve the UK’s overall cyber resilience. Key benefits of certification include:
- Demonstrating to customers and partners that you take cyber security seriously
- Enhancing your reputation and attracting new business
- Gaining a clear picture of your organization’s cyber maturity
- Meeting requirements for bidding on certain UK government contracts
Certification is available for organizations inside and outside the UK, and it is applicable across sectors and organization sizes.
Since 2014, the UK Government has required Cyber Essentials certification for suppliers handling sensitive or personal information. Today, individual departments may define additional or specific requirements, so expectations should be confirmed per contract.
Cyber Essentials is not a legal requirement; therefore, failure to comply does not result in direct financial penalties. However, consequences may include:
- Losing eligibility for public sector contracts
- Increased exposure to common cyber threats
- Reduced trust from customers, partners, or stakeholders
With the introduction of v3.3 (“Danzell”), the scheme continues to strengthen its alignment with modern IT environments, including cloud adoption, remote working, and evolving identity and access practices—further reinforcing its relevance as a baseline security standard.
Special Focus: Cyber Essentials for Education and the RPA
Cyber attacks targeting UK schools have increased in recent years. To address this, the IASME Consortium, together with the Risk Protection Arrangement (RPA), has developed a tailored Cyber Essentials approach for the education sector.
The RPA, an alternative to commercial insurance for public sector schools in England, includes cyber insurance coverage. To remain eligible, participating schools must meet defined technical controls and training requirements aligned with Cyber Essentials. Additional details are available through official UK Government resources.
How to achieve Cyber Essentials (UK) compliance?
Once payment is made through the official IASME certification site, organizations receive login credentials for a secure online platform to complete the official self-assessment. The questions mirror those available on the Centraleyes platform for preparation.
A board-level representative must sign a declaration confirming that the answers provided are accurate. A qualified assessor from an IASME-approved Certification Body will then review the responses. If successful, a certificate is issued. If not, the organization receives feedback to improve and reapply.
The best way to streamline this process is to use a dedicated compliance platform. Centraleyes offers a built-in Cyber Essentials v3.3 questionnaire, along with automated scoring, remediation guidance, evidence collection, and workflow tracking – helping your organization prepare with speed and confidence.
Read more: UK NCSC website
Guide for IT Infrastructure: https://www.gov.uk/government/publications/cyber-essentials-scheme-overview