Cyber Essentials is a UK government-backed scheme that certifies organisations against the cyber attacks seen most often. It doesn't claim to stop every incident. It sets a recognised bar for the controls that prevent most of them.
Two levels of certification
Cyber Essentials is a self-assessment. You answer questions about your security controls and send evidence. An approved body then reviews what you've submitted. You receive a certificate or a list of gaps.
Cyber Essentials Plus uses that questionnaire and adds an independent technical audit. A qualified assessor tests the systems to confirm the controls operate as described.
The five controls
Both levels measure the same five areas:
-
Firewalls. The internet connection must sit behind a correctly set firewall. Factory-set passwords are changed. Unused services are switched off.
-
Secure configuration. Devices and software must be set up to reduce known weaknesses. Unused accounts and unused functions come out.
-
User access control. Admin logins stay reserved for admin work. Each person gets only the permissions the role needs. Multi-factor authentication must be in force.
-
Malware protection. Anti-malware software must be present and current, or you use allow-listing instead.
-
Patch management. Operating systems and applications must take a critical update within 14 days of release.
Why it matters
Government contracts. From 2014, the scheme has been required on UK government contracts that involve handling sensitive data.
Supply chain requirements. Larger buyers now ask suppliers to hold the certificate before they place work.
Insurance. Certain cyber insurance policies treat it as the entry standard, or they'll reduce the premium when you hold it.
Baseline protection. The NCSC puts the protection at around 80% of common cyber attacks. Further controls still sit outside that figure.
What it costs
- Cyber Essentials (self-assessment): £300 to £500 in certification fees, plus the cost of any fixes
- Cyber Essentials Plus (technical audit): £1,500 to £3,000, scaled to the size and complexity of the organisation
The certificate runs for 12 months. You apply again each year.
Common reasons businesses fail
- Multi-factor authentication missing from some cloud services
- Operating systems that have left support, Windows 10 past its end of life among them
- Staff devices used for company data without security controls applied
- Firewall rules that let through more traffic than the business needs
- Critical updates sitting longer than the 14-day requirement
Automation on the same estate
Workflow automation connects to the accounts, files and networks this scheme inspects. If those systems fail the five controls, the automation inherits the same gap.
How Wanzo helps
Wanzo runs the process from the first review of your controls through the fixes and the submission. Clients on managed IT already have patching, firewall configuration and access control in the monthly retainer, so the yearly assessment follows work already under way. The same five areas sit inside our cybersecurity service.
What to do next
If a buyer, insurer or government contract has asked for the certificate, send the deadline and the systems in scope through the contact page. We'll confirm whether the self-assessment is enough or whether Plus is required. y.