You’re a US vendor bidding UK public-sector work, or a UK enterprise customer has added Cyber Essentials to its supplier checklist, and the tender won’t move until you hold a current certificate. The controls sound basic, but the scheme is strict about scope, cloud services, remote workers and unsupported software, and one wrong answer can mean a failed assessment. Readiness gets your estate and your answers right so you go to the certification body confident.
Cyber Essentials is the UK government-backed scheme that sets a baseline of technical controls against the most common internet-based attacks. The National Cyber Security Centre owns the technical requirements and IASME runs the scheme, licensing the certification bodies that assess applicants. It covers five controls: firewalls, secure configuration, security update management, user access control and malware protection.
There are two levels. Cyber Essentials is a verified self-assessment: you answer IASME’s question set, a board-level or equivalent signatory confirms the answers, and a certification body reviews them. Cyber Essentials Plus adds a hands-on technical audit by the certification body, including vulnerability scans and tests on a sample of your devices and user accounts, and builds on a current Cyber Essentials certificate. Certificates are renewed annually, and the requirements are revised periodically.
UK central government requires Cyber Essentials for contracts that involve handling citizens’ personal data or supplying certain ICT systems and services, and the Ministry of Defence uses it in its supplier cyber risk process. Many UK enterprises, universities and health bodies now ask for it too. For a US company, the hard questions are usually scope: which legal entity, which offices, which cloud tenants and which laptops the certificate will cover.
A tender lists Cyber Essentials or Cyber Essentials Plus as a condition of award. You need a certificate whose scope covers the service you are bidding, and you need to understand what the certification body will expect of a US-headquartered estate.
A prime contractor has flowed down the Ministry of Defence’s supplier cyber requirements and your risk profile calls for Cyber Essentials or Plus. You want your controls and scope settled before the prime’s deadline arrives.
UK customers increasingly treat Cyber Essentials as table stakes in security reviews. You want to certify the part of your business that serves them without disrupting how your US teams work.
A previous attempt stalled on unsupported operating systems, missing multi-factor authentication or out-of-date devices. You want those problems found and fixed on your own terms before you apply again.
An IASME-licensed certification body of your choice
Cyber Essentials or Cyber Essentials Plus certificate, published on the scheme’s certificate search
The certification body reviews your answers and, for Plus, audits your systems. Readiness happens first and separately, so the firm that prepares you is never the one that certifies you, and what reaches the certification body already reflects how your estate really works.
A clear description of the organization or sub-set you will certify, the networks, devices, users and cloud services inside it, and how the boundary is enforced.
Every requirement across the five controls marked met, partly met or not met for your estate, with the fix needed for each gap.
The end-user devices, servers, network devices and software in scope, with the supported versions and update status the scheme asks about.
The specific configuration, update, account and authentication changes that close your gaps, prioritized so the items most likely to fail an assessment come first.
Answers to the current question set written from your actual configuration, with notes your signatory can read before confirming them.
What a Cyber Essentials Plus audit examines on sampled devices and accounts, and the evidence and access the certification body will need from you.
Short, usable standards for patching, accounts, device builds and remote working that keep you compliant between annual renewals.
Better found now, by people on your side, than by your assessor.
Cloud services left out of scope even though the scheme counts them whenever your organization uses them
Multi-factor authentication missing on one or more cloud services or administrator accounts
Unsupported operating systems or applications still in use and not segregated from the scope
High and critical security updates applied later than the scheme allows
Personal devices used for email or company data with no defined controls
Administrators doing everyday work, including email and browsing, from privileged accounts
Default or shared passwords on routers, firewalls and other network devices
A sub-set scope with no real network separation from the rest of the business
Cyber Essentials Plus includes vulnerability scanning of your internet-facing systems and sampled devices, so a scan of your own first shows missing updates and weak configurations before the certification body does.
What the test coversThe firewall control turns on what is exposed at your boundary. Testing your external footprint finds open administrative interfaces and forgotten services that would fail that requirement.
What the test coversCloud services are in scope, and multi-factor authentication, administrator separation and secure configuration there are frequent reasons for failure.
What the test coversYes. The scheme is open to organizations outside the UK, and you can certify the whole company or a defined sub-set, such as a UK subsidiary or the environment that delivers a UK service. What matters is that the scope matches what your UK customer needs covered and that the boundary is real.
Check the contract or tender first: some buyers accept the basic certificate, others name Plus. Cyber Essentials is a verified self-assessment, while Plus adds a technical audit of your systems by the certification body. Plus requires a current Cyber Essentials certificate, so you normally obtain the basic level first.
Home workers’ company devices are in scope, and the firewall requirement shifts to the device itself when staff work from home. Personal devices that access organizational data or services, including email, are also in scope, with narrow exceptions such as devices used only for calls, texts or authenticator apps. Many failures come from not deciding this before applying.
Yes. If your organization uses a cloud service, it is in scope. The cloud provider is responsible for some controls and you for others, and you must show you meet your share, including multi-factor authentication for every user on those services.
An IASME-licensed certification body that you choose. It reviews your self-assessment and, for Plus, carries out the technical audit. Readiness is separate and comes first, so the body you pay for certification gets an application that already holds up.
No. Cyber Essentials checks five technical controls; ISO 27001 certifies a full information security management system, and SOC 2 reports on controls against the Trust Services Criteria. UK buyers often ask for Cyber Essentials alongside them, and the work overlaps, so readiness reuses what you already have.
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.
Not sure where to start? One of our testers reviews your internet-facing footprint and sends you a short summary of what an attacker would see — free. Nothing you don’t own is ever touched, and there’s no sales sequence.
Free. No obligation.
