Cyber Essentials

A UK government-backed certification covering five basic security controls. Often required to bid for public sector work.

What it means

Cyber Essentials is a certification scheme covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.

Cyber Essentials Plus adds independent technical verification.

Why it matters

It is a contractual requirement for many central government contracts and increasingly for supply chains and larger private buyers.

The controls themselves are the basics, and the NCSC's position is that they address a large proportion of common internet-originated attacks.

What it looks like in practice

The self-assessment is a questionnaire and the certification fee is modest and scaled by organisation size.

Most of the work is not the assessment; it is discovering that some machines are unpatched, some accounts are shared, and some administrator rights are handed out routinely.

Certification lasts a year and must be renewed. The technical requirements are updated periodically.

What to watch out for

Scope. Certifying only part of the organisation is allowed and must be declared, and a customer may want the whole thing.

Treating it as the finish line. It is a floor, not a security programme, and it says nothing about backups or staff awareness.

Where to get proper advice

The NCSC and IASME, which runs the scheme, publish the requirements and a list of certification bodies.