Cyber Essentials Requirements: A Guide to Stay Compliant
Cyber Essentials requirements confuse most business owners I meet. They hear about the certification process and five technical controls from the National Cyber Security Centre and immediately think it sounds complicated.
The reality is simpler. Over 32% of UK small businesses reported a cyber attack in the past year. Most of these common cyber attacks could have been stopped by following the basic security controls this Government-backed scheme covers. For a broader introduction before diving into the requirements themselves, see our plain-English guide to what Cyber Essentials is and why UK small businesses need it.
This guide breaks down what organisations of all sizes actually need to do. No jargon. Just the real Cyber Essentials requirements explained in plain English, including the 2025 updates.
Cyber Essentials Requirements – The Simple Truth
Cyber Essentials requirements start with one basic fact. The Cyber Essentials scheme asks you to implement five technical controls that stop about 80% of most common cyber attacks targeting IT systems and sensitive data.
Here’s what I tell organisations when they ask about this certification scheme. Think of it like locking your doors at night. You don’t need expensive security systems to stop most external threats. You just need to do the basics properly across your user devices and network devices.
The government backs this scheme because these cyber security measures work. Over 215,000 certificates have been awarded since 2014. But only 12% of UK businesses even know the Cyber Essentials standard exists. That means most companies are missing out on cost effective protection against cyber criminals.
When you’re ready to get Cyber Essentials certification, working with a Cyber Essentials consultant can help you understand which technical requirements apply to your business needs.
Key Point
The main thing to remember: The Cyber Essentials controls aren’t about being perfect. They’re about closing the gaps that cyber criminals look for first when targeting user devices with unauthorised access attempts.
Most common cyber threats succeed because organisations skip basic steps like patch management or strong passwords. Fix those basics through proper cyber security controls, and you stop most problems before they start.
The Five Technical Controls Explained
Every Cyber Essentials requirement fits into five control areas. I’ve seen organisations panic when they first look at the technical requirements on GOV.UK. But once you understand what each control means for your security systems, it makes sense.
1. Firewalls and Internet Gateways
This control protects what comes in and out of your network devices. You need to turn on firewalls (most operating systems have them built in), change default passwords on network devices, block connections you don’t need, document your rules, and use software firewall on mobile devices when staff work remotely to protect their browsing experience.
The firewall configuration process isn’t as technical as it sounds for protecting against external threats.
2. Secure Configuration
This control area covers setting up IT systems safely from the start. Most known security issues happen because things are left with default settings that grant access to unnecessary user accounts. You need to remove unnecessary software, disable auto-run features, set up device locking with strong passwords, change factory settings, and remove unnecessary user accounts so only authorised individuals have access.
My guide on secure configuration best practices walks through common mistakes with security patches and user permissions.
3. Security Update Management
This causes more failures in the Cyber Essentials assessment than any other requirement. You have 14 days to install critical security patches (CVSS v3 score of 7 or above) once they’re released for patch management compliance.
The rule for security update management: All software must be supported, automatic updates enabled where possible, critical patches installed within 14 days, updates tracked to prevent brute-force attacks, and vendor recommendations followed for known security issues.
The 2025 update expanded “vulnerability fixes” to include configuration changes and scripts, not just traditional security patches. This matters because some vulnerabilities get fixed through settings rather than software updates.
Watch Out
Most organisations fail here: Running unsupported software on network devices. If you’re using Windows 10 22H2, you’ve got until October 2025 before it becomes a problem for your Cyber Essentials accreditation and government contracts eligibility.
4. User Access Control
This requirement manages who accesses your IT systems. Multi-factor authentication is now mandatory for cloud services to protect sensitive data from credential theft.
Key requirements: Everyone needs their own account (no sharing), strong passwords (at least 12 characters or 8 with multi-factor authentication), mandatory MFA for cloud services, separate admin accounts for administrative activities (don’t browse the web using administrative accounts), remove old accounts when people leave, protect against brute-force attacks with account lockouts, and set up clear password policy.
The April 2025 update added passwordless authentication as an option for user access control. My user access control guide covers these approaches.
5. Malware Protection
The final Cyber Essentials control is about preventing malware from running on security systems. You have two choices to prevent malware: anti-malware software (must scan real-time, update regularly, block malicious websites) or application allow-listing (only approved software runs on user devices).
For most small businesses, antivirus software is simpler for malware protection. The malware protection approach you choose depends on your setup.
Cyber Essentials Basic vs Cyber Essentials Plus Certification
There’s a key difference between the two levels of this certification scheme. Both cover the same five Cyber Essentials controls, but verify them differently.
| Aspect | Cyber Essentials Basic | Cyber Essentials Plus |
|---|---|---|
| Method | Self-assessment via Cyber Essentials checklist | Plus audit with technical assessment |
| Testing | No external audit | Vulnerability scan and hands-on verification |
| Timeline | 1-3 business days typically | 5-10 working days with Test Specification review |
| Use Case | Most government contracts, supply chain security | Higher level assurance, MOD, NHS contracts |
The key difference between CE and CE+ is the external verification through technical audit. Plus certification provides higher assurance to third-party clients about your cybersecurity measures.
Common Mistakes in the Cyber Essentials Assessment
I see the same problems repeatedly when organisations attempt the certification process. These failures slow things down and cost time fixing issues that could have been avoided.
Unsupported Software and Operating Systems
This is the top failure point. Running unsupported software means no security patches are available, which breaks certification requirements. Check operating systems on all user devices and mobile devices, applications, firmware on routers and security systems, and cloud services from third-party providers. Before you apply, run a Cyber Essentials readiness check to catch the gaps.
Poor Patch Management
The 14-day rule for security patches trips up many organisations. You need systems to track when updates are released and ensure they’re applied to IT systems promptly. Common failures include not tracking patch status across user devices, missing updates on mobile devices, relying on automatic updates that failed, no process for manual patches, and forgetting third-party software.
Missing Multi-Factor Authentication
This became mandatory in 2022 for cloud services but still causes failures. Microsoft 365, Google Workspace, cloud storage, business applications accessed over internet, and any service storing sensitive data all need MFA enabled for proper user access control.
No Separation of Administrative Accounts
Users shouldn’t browse the web using admin accounts. You need separate accounts for administrative activities versus daily work. This separation protects IT systems – if malware gets in through phishing, it only gets standard user permissions rather than administrative accounts rights that could compromise your entire network.
Gap Analysis Warning
Don’t skip preparation for the Cyber Essentials assessment. Do a gap analysis of your current security measures first. Compare your IT systems against the five control areas, identify what needs fixing, make the changes, then apply. This saves you from failing and delays getting government contracts started.
What the April 2025 Updates Mean
The National Cyber Security Centre updated requirements in April 2025. The new “Willow” Question Set replaced old Montpellier questions in the certification process. Passwordless authentication (biometrics, security keys, one-time codes) is now acceptable for user access control. “Vulnerability fixes” expanded to include configuration changes, not just security patches, for addressing known security issues. “Home working” changed to “home and remote working” to reflect modern work across user devices. Device sampling guidance updated for the Plus audit technical assessment.
These changes make the certification scheme more relevant for modern IT systems with cloud services and hybrid teams spread across mobile devices and network devices.
Who Needs This Certification Scheme?
The Cyber Essentials standard isn’t legally mandatory for every UK organisation with any annual turnover. But certain situations make it essential. Since 2014, government contracts handling personal information require it. Many larger organisations require third-party suppliers to be certified for supply chain security. Some insurers require certification for coverage or offer better premiums to certified organisations of all sizes.
Beyond mandatory requirements, I recommend the Government-backed scheme for small businesses and Medium Enterprises wanting customer confidence, cost effective protection, an action plan for cybersecurity measures, peace of mind about protecting sensitive data, and competitive advantage when clients compare security systems and risk management approaches.
Need Help Getting Certified?
I help UK organisations understand which security measures they need and prepare for the certification process with practical guidance on implementing the five technical controls properly.
Learn more about my Cyber Essentials consulting services.
Common Questions About Cyber Essentials Requirements
Do all UK organisations need Cyber Essentials certification?
No, the certification scheme isn’t legally mandatory for all organisations. You need it for specific government contracts that handle personal information or sensitive data at OFFICIAL level. Many private sector companies also require it from third-party suppliers for supply chain security. Beyond these requirements, it’s optional but recommended as a cost effective way to implement basic security controls against common cyber attacks. The certification requirements help small businesses and Medium Enterprises protect their IT systems without needing expensive security specialists or complex security systems.
What’s the difference between the five technical controls and other cybersecurity measures?
The five Cyber Essentials controls (firewalls and Internet gateways, secure configuration, security update management, user access control, and malware protection) cover minimum security measures needed to stop most common cyber threats. These control areas protect user devices, network devices, and IT systems from external threats like cyber criminals exploiting known security issues. Other cybersecurity measures like backup systems, security awareness training, and penetration testing with vulnerability scan go beyond certification requirements but aren’t part of the Government-backed scheme. Think of the Cyber Essentials standard as essential foundations that every organisation needs, while additional security systems build on those foundations based on specific business needs.
How do mobile devices fit into the Cyber Essentials assessment scope?
Mobile devices that access your organisation’s sensitive data or cloud services are in scope for the technical requirements. This includes smartphones and tablets used for work, whether company-owned or under BYOD arrangements. These user devices need malware protection where available, security patches applied within 14 days following vendor recommendations, strong passwords or biometric authentication, and proper user access control. However, mobile devices used only for voice calls, text messages, or multi-factor authentication aren’t in scope. The certification process checks how you manage operating systems updates on mobile devices, whether unnecessary software is removed, and if multi-factor authentication protects access to cloud services.
Why does patch management cause so many certification failures?
Security update management fails frequently because organisations don’t track security patches properly across all IT systems. The 14-day rule for critical updates (CVSS v3 score of 7 or above) seems simple until you’re managing hundreds of user devices and network devices with different operating systems and software. Many businesses forget about third-party applications needing manual updates, or they rely on automatic security patches that failed silently. Unsupported software is another common problem – you can’t get security patches for old operating systems or applications, which immediately breaks certification requirements. The April 2025 update expanded “vulnerability fixes” to include configuration changes and scripts, not just traditional patches, adding complexity to patch management for organisations of all sizes.
How does Cyber Essentials connect to supply chain security?
Large organisations increasingly require third-party suppliers to demonstrate basic security controls before sharing sensitive data or connecting to their IT systems. The Government-backed scheme provides standardised proof that you meet minimum technical requirements for protecting against common cyber threats. When clients do supply chain security reviews, Cyber Essentials accreditation answers their basic questions about your security measures – do you have firewalls on network devices, proper patch management, multi-factor authentication for user access control, malware protection, and unauthorised access prevention? This saves time during vendor assessments and gives clients peace of mind that cyber criminals can’t easily use your organisation as a stepping stone. For many supply chains, the certification has become a gate-keeper – without it, you don’t even get considered for government contracts, regardless of your actual security systems. The 12-month renewal cycle ensures suppliers maintain their security measures over time.
Understanding Cyber Essentials requirements doesn’t have to be complicated for your UK organisation. The certification scheme focuses on five straightforward technical controls that stop most common cyber attacks against IT systems. Implement strong passwords and multi-factor authentication for user access control. Keep security patches current within 14 days through patch management. Enable malware protection on user devices and mobile devices. Configure network devices properly with firewalls and Internet gateways. Remove unnecessary software and unnecessary user accounts. These basic security controls form a cost effective foundation that protects sensitive data while meeting government contracts requirements and reassuring clients about your supply chain security approach through this National Cyber Security Centre backed certification process.
