ESSENTIAL GUIDANCE · COMPLETE GUIDE · 14 min read
Part of Foundation insights →Cyber Essentials: the complete guide for UK businesses
A practical guide to the five Cyber Essentials controls, certification routes, preparation, costs, evidence and annual renewal.
A practical guide to the five Cyber Essentialsi controls, certification routes, preparation, costs, evidence and annual renewal.
Need an acronym translated?Open the cyber glossary →What Cyber Essentials is designed to do
Cyber Essentials is a UK government-backed certification scheme focused on protections against common cyber attacks. It is deliberately narrower than a complete security programme: the aim is to establish a practical baseline that removes avoidable weaknesses across internet-connected technology. Organisations use the certificate to support customer assurance, supplier onboarding, insurance conversations and eligibility for certain contracts. The security value comes from applying the controls consistently across the agreed scope, not simply completing a questionnaire.
The five controls at the centre of the scheme
The scheme assesses firewalls, secure configuration, security update management, user access control and malware protection. Together, these controls reduce common routes such as unnecessary internet exposure, insecure defaults, unsupported software, excessive privilege and malicious code. They are connected: a patched device can still be exposed by a poor firewall rule, while strong malware protection cannot compensate for unmanaged administrator access. Preparation should therefore examine the complete operating baseline rather than treating each answer as an isolated compliance statement.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials uses a verified self-assessment. The organisation describes how the controls operate across its agreed scope and an authorised certification body reviews the submission. Cyber Essentials Plusi covers the same five controls and adds independent technical testing of a representative sample. Plus provides stronger evidence that the controls are working in practice, but it is not a broad penetration test. The right level depends on what customers, tenders, insurers and internal stakeholders expect to see.
Scope is the first important decision
Scope determines which legal entities, users, devices, networks and cloud services the answers cover. Home working, bring-your-own-device arrangements, externally managed systems and cloud applications can make the boundary less obvious than it first appears. An incomplete scope creates late evidence gaps and inconsistent answers. Build an accurate inventory, confirm ownership and record any justified exclusions before drafting the formal submission. The scope should describe the live organisation, not the simplest boundary to document.
How to prepare without a last-minute scramble
Start by identifying unsupported technology, public services, administrator accounts, cloud authentication and the process for security updates. Remove unnecessary accounts and services, replace insecure defaults, enable multi-factor authentication where required and confirm that high-risk fixes are applied within the scheme timescale. Collect evidence as changes are made: asset records, screenshots, policies, configuration exports and named control owners. A readiness review tests the likely answers and evidence while there is still time to remediate.
Common causes of delay or failure
Applications are commonly delayed by unclear scope, unsupported operating systems, inconsistent multi-factor authentication, weak administrator separation and security updates that cannot be evidenced. Another frequent problem is answering from policy rather than observed configuration: a written requirement may exist even though devices or cloud accounts do not follow it consistently. Treat every answer as a statement that must be true across the scope. Where exceptions exist, understand and resolve them before submission rather than hoping they will not be sampled.
Costs, timings and choosing support
Certification cost varies with organisation size, the selected certification body and whether the organisation chooses Cyber Essentials or Plus. Preparation effort depends more heavily on scope complexity and the number of gaps. A relatively mature small organisation may prepare quickly; a distributed estate with legacy systems can require a longer remediation programme. Ask providers to separate readiness support, remediation work and third-party certification fees so the commercial comparison is clear. The useful question is not only how quickly a certificate can be issued, but how confidently the controls can be evidenced.
Certification lasts for twelve months
Cyber Essentials certification is renewed annually. Controls can drift between assessments as staff join, services change and software approaches end of support. Assign owners, retain evidence and schedule a review well before renewal. Continuous exposure monitoring and targeted validation can help identify changes that undermine the baseline during the year. Pentesys Foundation supports scope definition, readiness assessment, remediation planning and evidence preparation; formal certification is completed through an authorised certification body.
