Cyber Essentials and Cyber Essentials Plus: what it takes to pass in 2026

What Cyber Essentials is, and why people ask for it#

Cyber Essentials is a UK government backed scheme, run by the NCSC and delivered by IASME through licensed Certification Bodies. It sets a baseline of five technical controls that stop the most common, low-effort attacks: the ones that come from the internet and rely on default settings, unpatched software and weak access control.

It comes up for three practical reasons. Many UK government contracts require it, as do a growing number of commercial customers and supply chain questionnaires. It gives you a defined, externally checked standard instead of an argument about what "good enough" means. And the process forces an honest look at the estate, which is often the most useful part.

It is not a full security programme. It does not require logging, detection, incident response, or backups. I will come back to that at the end.

Cyber Essentials vs Cyber Essentials Plus#

The controls are identical. What changes is how much anyone checks.

Cyber Essentials is a verified self-assessment. You answer a questionnaire, a board level member of the organisation signs a declaration that the answers are true, and an assessor marks it. There is no vulnerability scan and nobody looks at your devices.

Cyber Essentials Plus starts with the same questionnaire and adds a technical audit. An assessor scans your internet-facing addresses, then tests a sample of your devices and cloud accounts to confirm the controls are actually working. The audit can be done remotely or on site, and it is quoted individually by each Certification Body because it depends on the size and complexity of your estate.

Both certificates last 12 months.

What changed in April 2026#

If you certified before, read this part, because the marking got stricter. The current NCSC requirements are v3.3, effective from 27 April 2026, and new assessment accounts use IASME's Danzell question set. The headline changes:

• Cloud services are defined and cannot be excluded. A cloud service is an on-demand, scalable service on shared infrastructure, reached over the internet, accessed through an account (including one created with a business email address), that stores or processes your data. If your data lives there, it is in scope.
• MFA on cloud services is an auto-fail. If a cloud service offers MFA, whether free, included, via a linked service or as a paid upgrade, you must enable it for all users and administrators. Leaving it off fails the assessment.
• Late critical updates are an auto-fail. Two questions (A6.4 and A6.5) ask whether critical and high-risk updates for operating systems, firmware, and applications are installed within 14 days. A "no" to either fails the assessment, whatever else you got right.
• Passwordless includes FIDO2. The definition now names FIDO2 authenticators and passkeys, and treats FIDO2 as MFA.
• Scoping wording is simpler. The phrase "untrusted connections" has gone. Any in-scope device that can connect to or from the internet is covered.
• Software development points to the Software Security Code of Practice, and the importance of backups is emphasised, although backups are still not a technical requirement.

Assessment accounts created before the cutover could finish on the old version, but anything started now uses the new rules.

Step one: get the scope right#

Scope is the part most people rush, and it is where most surprises come from. The rules, from the requirements document:

• Your assessment covers the whole IT infrastructure used for your business, or a well-defined, separately managed sub-set. You agree the boundary with the Certification Body before assessment starts.
• A scope that does not include end-user devices is not acceptable.
• Whole organisation is the strongest option. If you exclude parts of your infrastructure you have to justify it to the assessor, and any excluded network must be properly segregated by a firewall or VLAN.
• Home and remote workers are in scope, whether the device is corporate or BYOD. If you supply the router, the router is in scope. Staff using their own home router are covered by software firewalls on the device, or by connecting through your corporate VPN.
• BYOD that touches organisational data or services is in scope. Phones used only for calls, texts and MFA apps are out.
• Cloud services are in scope, including SaaS tools that individuals signed up for with a work email.
• Accounts used by third parties are in scope. That includes MSP, supplier and contractor accounts on your systems, and you must be able to show the controls are met on managed infrastructure.
• Devices that third parties own are mostly out of scope, for example an MSP administrator's or contractor's own laptop. You are still responsible for making sure they are configured correctly when they access your data, just not through the assessment.

A useful exercise before anything else is a simple inventory: every device type, every operating system and version, every cloud service, every internet connection and every account used by a third party. Everything that follows depends on that list being right.

The five controls#

1. Firewalls#

The aim: only necessary, secure services are reachable from the internet.

What you must do:

• Protect every in-scope device with a correctly configured firewall. A boundary firewall covers devices behind it, and a software firewall covers devices on networks you do not control. Windows and macOS include one, and the advice is to use it.
• Change default administrative passwords on firewalls to strong, unique ones, or disable remote administration entirely.
• Do not expose the firewall management interface to the internet unless there is a documented business need, and then protect it with MFA, or an IP allow list combined with proper password management.
• Block unauthenticated inbound connections by default.
• Have every inbound rule approved and documented by an authorised person, with the business reason recorded.
• Remove rules you no longer need. The questionnaire asks whether you have reviewed your rules in the last 12 months.

Where people slip: management interfaces left open to the internet for the MSP's convenience, old port forwards that nobody remembers, and laptops with the software firewall off.

2. Secure configuration#

The aim: devices run only what they need, without insecure defaults.

What you must do, regularly:

• Remove or disable unnecessary accounts, such as guest accounts and unused admin accounts.
• Change default or guessable passwords.
• Remove or disable unnecessary software, utilities and services.
• Disable auto-run features that execute files without user permission.
• Require users to authenticate before accessing data or services.
• Lock devices when someone is physically present, and protect that unlock against brute force: no more than 10 guesses in 5 minutes, or a lock after no more than 10 failed attempts. A device unlock credential on its own needs at least 6 characters, but if it is also used to authenticate to services, the full password rules apply.

Where people slip: forgotten local accounts on old machines, default passwords on printers and network kit, and phones with no lock enforced.

3. Security update management#

The aim: nothing in scope is vulnerable to a known problem that has a fix.

What you must do:

• Run only licensed and supported software. Operating systems, firewall and router firmware, browsers, office applications, and the rest.
• Remove unsupported software from devices, or remove those devices from scope using a segregated sub-set with no internet traffic in either direction.
• Turn on automatic updates where possible.
• Install updates within 14 days of release when the vendor calls them critical or high risk, when the vulnerability scores CVSS v3 7.0 or higher, or when the vendor does not say how severe the problem is. If one update bundles several fixes and any is critical or high, the whole update is due within 14 days.

Unsupported software in scope is an automatic fail. That has real consequences. Windows 10 reached end of support on 14 October 2025, so any Windows 10 device still in scope needs to be upgraded, removed from scope, or covered by an arrangement your assessor will accept. Confirm that with your Certification Body before relying on it.

Where people slip: the browser extension that has not updated in two years, the firewall firmware three versions behind, the one unsupported laptop on the finance desk, and update deadlines that are 30 days rather than 14.

4. User access control#

The aim: only the right people have accounts, with only the access they need.

What you must do:

• Have a process to create and approve accounts.
• Use unique credentials. No shared logins.
• Remove or disable accounts when people leave, or after a defined period of inactivity.
• Use MFA wherever it is available. For cloud services this is mandatory, and it is now an auto-fail.
• Use separate accounts for administrative tasks, with no email or web browsing on admin accounts.
• Remove special privileges when roles change.
• Track who holds admin accounts, and review that regularly.

For password-based authentication the standard is more modern than many people expect. You must protect against brute force, and manage password quality with either MFA, a minimum length of 12 characters, or a minimum of 8 characters with a deny list that blocks common passwords. You should support users with password managers and three random words, and you should not enforce regular password expiry or complexity rules.

Where people slip: a cloud tool nobody enabled MFA on, admins using their daily account for admin work, leavers' accounts that still work, and shared accounts.

5. Malware protection#

The aim: stop known malware and untrusted software from running.

For every in-scope device you need at least one of:

• Anti-malware software, which must be kept up to date, prevent malware from running, prevent malicious code from executing, and block connections to malicious websites.
• Application allow listing, where only approved, code-signed applications can run, you actively approve each application, and users cannot install anything unsigned.

Where people slip: a server or a Mac with no protection at all, protection that is installed but not updating, and web filtering turned off for a group of users.

A word on backups#

Backups are not a Cyber Essentials requirement, though v3.3 emphasises them more strongly. Do them anyway. A backup that you have not tested restoring is a hope, which I covered in the post on Azure Backup restore drills.

Walking through the Cyber Essentials self-assessment#

Here is the process, step by step, based on IASME's published guidance.

1. Download the question set first. The Danzell questions are free to download as a PDF or spreadsheet, and IASME offers a free readiness tool. Prepare your answers before paying, because the questions will tell you quickly what you are missing.
2. Settle your scope and inventory. Have the device, OS, cloud service, internet connection, and third-party account lists ready.
3. Apply and pay. IASME's published prices are tiered by size: from £320 plus VAT for micro organisations (0 to 9 employees) up to £600 plus VAT for large ones (250 or more). Certification Bodies and consultants may add support on top. Check eligibility for the cyber insurance that is included with certification, which has its own conditions.
4. Complete the questionnaire in the portal. You have six months from the day you pay. If you have prepared, it can take about an hour. The sections cover the organisation, scope, firewalls, secure configuration, update management, user access control, and malware protection.
5. Get board level sign-off. A board member or equivalent has to sign the declaration that the answers are true. Do not delegate that without reading the answers.
6. The assessor marks it. Most aim to respond within about three days.
7. If you fail, you get two working days to fix simple issues and resubmit at no extra cost. After that you reapply and pay again.
8. Certify and diarise renewal. The certificate lasts 12 months, and you re-enter all the answers each year, because the questions change. Keep a copy of your answers.

The three automatic fails to check before you submit:

• Any unsupported or unlicensed software in scope (see A6.1 to A6.3).
• Any cloud service that offers MFA where you have not enabled it for administrators (A7.16) and all users (A7.17).
• Critical or high-risk updates that you do not install within 14 days (A6.4 for operating systems and firmware, A6.5 for applications).

Walking through Cyber Essentials Plus#

CE+ is the same standard, tested. The current test specification is v3.2. Here is how it works.

Before the audit#

• You need a valid Cyber Essentials certificate for the same scope. If it is less than three months old, you do not have to repeat the questionnaire. Otherwise you complete it as part of the process.
• You pick a Certification Body and get a quote. They are priced individually.
• The assessor verifies your scope against what is technically in place, and, where you certified a sub-set, checks the segregation actually works.
• The assessor chooses the sample. The devices to test must be declared to you no more than 72 hours or three working days before testing. For each operating system build or version, the minimum sample is 1 device if you have 1, 2 if you have 2 to 5, 3 for 6 to 19, 4 for 20 to 60, and 5 for 61 or more. Servers and cloud services are tested as well, and for each cloud service at least one normal user and one administrative user.
• You allow the assessor's test email and test website through, where needed.

The five test cases#

1. Remote vulnerability assessment. The assessor scans every internet-facing IP address you have, including any in IaaS, looking for what an opportunistic attacker could exploit.
2. Authenticated vulnerability scan of devices. Sampled end-user devices, servers and IaaS instances are scanned with an approved tool. A fail occurs if there is any critical, high-risk, or CVSS 7 or above vulnerability, or one with no severity information, where the vendor fix has been available for more than 14 days. Virtual patching is not accepted as a long-term answer for unsupported operating systems.
3. Malware protection. The assessor emails test files from an unfiltered external account, and has users download test files from a test website. Malware test files must be blocked. Executable test files must not run without a prompt that needs the user to act. If the tooling does not prove it either way, the assessor checks that anti-malware is installed, operating, and updating through logs. For allow listing, unsigned code and code signed by an untrusted certificate must not run.
4. MFA configuration on cloud services. Users and administrators attempt to sign in to each cloud service from an untrusted device or an incognito session. A fail occurs unless they are prompted for MFA before access is granted. Services sharing one identity provider are tested once.
5. Account separation. From a standard user account, the assessor has the user try an administrative task. A pass needs a prompt for separate credentials, with the process not running under the user's own account.

The result#

Every sub-test must pass. A single failure fails the assessment, with one narrow exception: at the Delivery Partner's discretion, a small number of minor issues, where the deviation is marginal (in less than 5% of tests) and does not point to a wider failure, may still pass. Do not plan on that. If testing cannot finish on the day, the recommendation is that it is not deferred for more than a month.

How to prepare, in practice#

Most of the hard work is things you can test yourself before the assessor does.

• Run your own authenticated scans against a sample of devices, and fix anything critical or high that has a fix older than 14 days. Defender Vulnerability Management or a scanner such as Nessus will show you something close to the list an assessor would see.
• Set update deadlines under 14 days. In Intune, use update rings or Windows Autopatch with a deadline, and cover third party apps and browsers as well as the operating system. Firmware on firewalls and routers counts.
• Check standard users cannot elevate without credentials. On Windows, a standard user should get a credential prompt when running something that needs admin rights. If staff are local admins, fix that first. Related reading: PowerShell guardrails for admins.
• List every cloud service and check its MFA options. IASME maintains a Cloud Services MFA list. Enforce MFA in Entra with Conditional Access for everything that uses it for sign-in, and do not forget the apps that have their own login. See conditional access patterns that survive real users.
• Send yourself the test case. Email an executable and a zipped file to a user through your normal filtering, and try downloading them. If they arrive and run, you will fail test case 3.
• Review leavers and admin accounts. Disable what is dead, and make sure admin accounts are separate from daily ones, tracked and reviewed.
• Check firewall rules and management access. Close management interfaces to the internet, remove old rules, and document the rest with the business reason.
• Decide how you will handle old devices. Replace them, upgrade them, or isolate them in a properly segregated sub-set with no internet access. A device left running unsupported software in scope is the commonest avoidable fail. The Windows 11 rollout checklist is a good starting point.

A rough mapping for a Microsoft estate#

If you run Intune and Entra, most of the five controls map to things you already manage.

• Firewalls: Windows Firewall policy through Intune endpoint security, plus a documented boundary firewall configuration, with admin access locked down.
• Secure configuration: Intune security baselines and compliance policies for device lock, auto-run, and unnecessary software and accounts.
• Update management: Windows update rings or Autopatch, app update policies, and a patch compliance report you check against the 14-day rule.
• User access control: Conditional Access requiring MFA, separate admin accounts with Privileged Identity Management where licensing allows, a leaver process tied to HR, Entra Password Protection to deny common passwords, and no forced expiry.
• Malware protection: Defender Antivirus or another managed anti-malware product, with tamper protection and web protection enabled.

If you use other tooling, the same ideas apply. The requirement is the outcome, not the product.

A four week plan#

• Week 1: inventory devices, operating systems, cloud services, internet connections and third-party accounts. Decide scope. Download the Danzell questions and answer them honestly in draft.
• Week 2: fix the auto-fail items. Remove or isolate unsupported software, enable MFA on every cloud service that supports it, and set update deadlines to 14 days or fewer.
• Week 3: clean up accounts and access. Remove leavers, split admin accounts, close firewall management, and review rules.
• Week 4: run your own scans, send your own test files, get the declaration signed, and submit. If you want CE+, book the audit within three months.

What Cyber Essentials does not cover#

Cyber Essentials is a good floor. It will not make you secure on its own, and it is worth being clear about the gaps.

• It does not require logging or detection. An attacker who gets past the controls can still operate unseen, which is the point I made in the post on the grey zone and living off the land.
• It focuses on the internet-facing threat model. Targeted attacks and insider risk are out of its scope.
• It does not test identity resilience beyond MFA on cloud services. Token theft and AiTM phishing can get round MFA that is switched on.
• It does not require incident response or tested recovery.
• It is a point in time. A certificate shows the answers were right on the day, so the controls have to hold on every other day too.

Treat the certificate as proof that you have a baseline, and use the preparation to build the habits that keep it true.

References#

Sources and further reading for the claims above.

• NCSC, Cyber Essentials help and resources (requirements v3.3 and CE+ test specification)
• NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3
• NCSC, Cyber Essentials Plus Test Specification v3.2
• IASME, Cyber Essentials frequently asked questions
• IASME, Important update: changes to Cyber Essentials for April 2026
• IASME, Upcoming changes to the Cyber Essentials scheme: April 2026 update
• IASME, CE self-assessment preparation booklet (Danzell question set)
• IASME, Cyber Essentials Plus sampling
• IASME, Cloud Services MFA list