UK Cyber Essentials Plus: The Definitive Certification Guide

What Cyber Essentials Is

Cyber Essentials is a UK government-backed certification scheme administered by the National Cyber Security Centre (NCSC). It defines a minimum baseline of cybersecurity controls protecting against the most common cyber attacks — the technical foundation that every organisation should have regardless of size or sector.

The scheme exists because the majority of cyber attacks exploit basic security weaknesses: missing patches, weak or default passwords, unnecessary services exposed to the internet, insufficient access controls. Cyber Essentials mandates controls addressing these fundamental vulnerabilities.

Cyber Essentials Plus adds an assessed verification layer: a qualified assessor performs hands-on testing to verify that required controls are implemented as claimed, rather than relying solely on a self-assessment questionnaire.

The Five Technical Controls

Firewalls and Internet Gateways

All devices with internet connectivity must be protected by a correctly configured firewall. Firewalls must be configured to allow only necessary inbound connections, with a default-deny policy. Default administrative passwords must be changed, unnecessary services must be disabled, and rules must be reviewed and approved.

Cloud-hosted systems are in scope — the requirement applies to cloud security groups and firewall configurations. Common gap: cloud resources with overly permissive security group rules allowing inbound access from any IP address to management ports.

Secure Configuration

All internet-facing devices must be securely configured. Default accounts and passwords must be changed or disabled. Unnecessary software, services, and user accounts must be removed. Auto-run features must be disabled.

Security Update Management

Software, operating systems, and firmware must be updated within 14 days when updates are rated high or critical risk. Software no longer receiving security updates must be removed from in-scope devices. Unsupported operating systems are a common finding that blocks certification.

User Access Control

User accounts must have only the permissions necessary for legitimate functions. Administrative privileges must be granted only where necessary. Multi-factor authentication must be implemented for all administrative access and for remote access to organisational systems.

The MFA requirement for administrative access is now mandatory — a significant change from earlier versions that treated MFA as a best practice rather than a requirement.

Malware Protection

All devices must have malware protection — anti-malware software or a whitelist approach. Protection must be active and receiving regular updates, with automatic scanning of files and downloads enabled.

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is based on a self-assessment questionnaire reviewed for internal consistency. No independent technical testing is performed.

Cyber Essentials Plus involves hands-on testing by a qualified assessor who samples in-scope devices and verifies by direct inspection that controls are implemented as described. The assessor attempts phishing emails against test accounts, verifies patch levels, checks firewall configurations, and validates malware protection status.

CE+ provides significantly stronger assurance than CE because it verifies implementation rather than relying on self-attestation. Government contracts that require CE+ explicitly require this verification.

Preparing for Certification

Common certification barriers: unsupported operating systems (Windows 7, Windows Server 2012, legacy Linux), internet-facing services without firewall protection, administrative accounts shared across multiple users, missing MFA for administrative and remote access, default credentials on network devices.

A pre-assessment review identifies these barriers before the formal assessment, allowing remediation before fees are committed. The additional cost of pre-assessment is typically recovered in reduced rework versus a failed assessment.