Cyber Essentials

What you are buying

Five controls, self-assessed

The whole scheme rests on five things: firewalls, secure configuration, security update management, user access control, and malware protection. That is it. There is no sixth control hiding somewhere, and no part of it asks about your policies, your training or your governance.

Because it is self-assessed, the honesty of the answers is doing all the work. The assessor is marking what you told them, not what is true. This is why Cyber Essentials is worth having and worth being sceptical about at the same time — and why a customer who asks whether you hold it is asking a weaker question than they think.

Cyber Essentials Plus is the same five controls, with somebody testing whether your answers were true.

Danzell — 27 April 2026

The question set changed, and it got harder

The Willow question set was replaced by Danzell. The shift is from interpretation to enforcement: things that used to be a non-compliance you could argue your way past are now an automatic fail.

• Multi-factor authentication is mandatory wherever it is available. If a cloud service offers MFA in any form and you have not turned it on, that is an automatic fail. It is no longer a finding you can carry.
• Cloud services cannot be scoped out. IASME now defines what a cloud service is, and business social media accounts are explicitly inside the boundary — with MFA on them.
• Not applying high and critical updates within fourteen days is now an automatic fail. Under Willow it was a major non-compliance. It is now the end of the assessment.
• The trusted-device exception is gone. If a device can accept an inbound connection or make an outbound one, it is in scope.
• Test and development environments block whole-organisation certification. If you have them, you cannot certify the whole organisation.
• Passwordless counts. FIDO2 passkeys, security keys and biometrics are treated as equivalent to MFA, which for many organisations is the easier route.

If your readiness checklist was written before April, it is checking the wrong things.

The one that catches people

You can go into Cyber Essentials Plus holding a certificate and come out with nothing

Plus is a technical audit on a sample of your devices. If that sample fails the vulnerability scan, you do not simply fix it and retest the same machines — a completely new sample of different devices is tested instead. If the second sample also fails, you fail Cyber Essentials Plus and your existing Cyber Essentials certificate is revoked.

Two related rules make that worse. No major non-compliances are permitted in the self-assessment before Plus testing can begin, and once testing starts you cannot amend your self-assessment answers. The optimistic answer you gave in March is the answer you are audited against.

That is the argument for answering accurately rather than hopefully. It is cheaper to fail the questionnaire than the audit.

What it costs

Certification fees, by organisation size

• Micro, 0 to 9 people — £320 + VAT
• Small, 10 to 49 — £440 + VAT
• Medium, 50 to 249 — £500 + VAT
• Large, 250 and above — £600 + VAT

Cyber Essentials Plus has no list price. A certification body quotes it against the size and complexity of your network, which is a polite way of saying it depends how many devices they have to test.

That is the certification fee. It is not the cost of being ready for it, and the gap between those two numbers is where most of the surprise lives.

Where this leads

It is often not the real requirement

Most organisations do not want Cyber Essentials. They want the thing on the other side of it: a tender they can bid for, an insurer that will quote, a customer's due-diligence questionnaire that stops arriving.

In defence it is more explicit. Cyber Essentials sits underneath DEFCON 658 and the Cyber Security Model, where the lowest risk profile requires it and the higher ones require Cyber Essentials Plus on top of substantially more control work. If a contract has sent you here, the certificate is the floor, not the ceiling.

Work out what is actually being asked of you before you buy the answer to a different question.

Being straight about it

You probably do not need us to pass this

A well-run small business with MFA switched on everywhere, software that updates itself, and a clear picture of its own devices can do Cyber Essentials alone. The question set is published — you can read every question before you spend anything. If that describes you, do it yourself and put the money somewhere it does more good.

Buying help is worth it in three situations. When your scope is genuinely unclear: several legal entities, contractors, personal devices, test environments. When you are going for Plus and cannot afford the revocation risk above. Or when the certificate is evidence for something larger — a tender, an insurance renewal, a defence contract — and the certificate alone will not satisfy whoever asked.

We would rather tell you to save your money than sell you a week of work you could do in an afternoon.