UK Cyber Essentials (NCSC)
What it is
A UK Government-backed certification scheme run by the National Cyber Security Centre (NCSC) and delivered by IASME. It certifies five technical controls that protect against the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection. It deliberately leaves out governance, risk assessment, incident response and backup.
Who needs it
Any UK organisation, and especially suppliers to UK government: since October 2014 it has been required for central government contracts that involve handling certain personal and sensitive information. Many private-sector buyers and cyber insurers ask for it too.
How it's assessed
Two levels. Cyber Essentials is a self-assessment questionnaire verified by a certification body; Cyber Essentials Plus adds hands-on technical verification by an assessor. Certificates last 12 months. Version 3.3 of the requirements (April 2026) states that cloud services can't be excluded from scope, and cloud accounts must always use multi-factor authentication.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Requirements
| ID | Requirement | Topics | Mapped in |
|---|---|---|---|
| Technical controls · 5 | |||
| CE 1 | Firewalls | Firewall / Net Seg | 9 of 13 |
| CE 2 | Secure Configuration | Secure Config, Mobile Security | 10 of 13 |
| CE 3 | Security Update Management | Asset Management, Vulnerability Mgmt, Patch Management | 13 of 13 |
| CE 4 | User Access Control | Access Control, Multi-Factor Auth, Privileged Access, Cloud Security | 12 of 13 |
| CE 5 | Malware protection | Endpoint Protection | 10 of 13 |
Topic coverage
Topics with mapped Cyber Essentials requirements (11):
No mapping in our data No Cyber Essentials requirement (39):