What is Cyber Essentials, and what does your business need to know in 2026?

What is Cyber Essentials, in plain terms?

Cyber Essentials is a scheme owned by the National Cyber Security Centre (NCSC) and run by IASME, which licenses the certification bodies that assess you. It doesn't try to cover everything. It targets the controls that stop the most common, low-skill attacks: a guessed or stolen password, an unpatched laptop, a default admin login on a router, a user who can install anything.

That narrow focus is the point. The NCSC reports that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance. It's also growing fast: 61,430 certificates were issued between July 2025 and June 2026, a record year. Even so, only 5% of UK businesses hold it, rising to 12% of small businesses and 35% of large ones (DSIT, 2026). If you bid for work, holding it still sets you apart.

This article replaces our separate Cyber Essentials checklist. The checklist now sits further down, updated for the 2026 requirements.

Cyber Essentials or Cyber Essentials Plus: what's the difference?

Both levels test the same five controls. The difference is who checks and how.

Tenders increasingly ask for Plus, because an audit proves the controls are working, not just described. If a buyer only asks for "Cyber Essentials", the basic certificate meets it.

What are the five controls, and what do assessors actually check?

Firewalls. Every device that connects to the internet must sit behind a correctly configured firewall. In an office that's usually the router or firewall appliance. For home workers, the device's own software firewall does the job, because the home router is outside your control. Default admin passwords on routers must be changed, and admin interfaces shouldn't be reachable from the internet.

Secure configuration. Remove software and accounts you don't use, change default passwords, and stop devices running things automatically from USB sticks. Passwords must be at least 12 characters, or 8 characters when combined with multi-factor authentication or an automatic block on common passwords.

User access control. Each person has their own account, admin rights are limited to the people who need them (and used through a separate admin account), and leavers are removed promptly. Multi-factor authentication is now mandatory on every cloud service that offers it.

Malware protection. Anti-malware software on every in-scope device, kept up to date, or application allow-listing (only approved apps can run) where that's more practical.

Security updates. Every operating system, app and piece of firmware must be supported by its maker, and critical or high-risk updates must be installed within 14 days of release. Windows 10 reached end of support on 14 October 2025. IASME treats any Windows 10 device in scope that isn't enrolled in Microsoft's paid Extended Security Updates programme as unsupported and not compliant, so each one has to be enrolled or replaced.

What changed in April 2026?

The requirements moved to version 3.3, with a new question set called Danzell, replacing the 2025 Willow question set. It applies to assessment accounts created from 27 April 2026. Accounts opened before that date had six months to finish under the old rules, so from late October 2026 everyone is on Danzell.

Four changes matter most. Multi-factor authentication must be switched on for every cloud service where it's available, and leaving it off is an automatic failure. Patching within 14 days now has two auto-fail questions, one for operating systems and firmware and one for applications. Cloud services can't be excluded from scope, and you must name every legal entity covered. And for Cyber Essentials Plus, a failed patching retest now samples new devices across a wider part of your estate, and a second failure means the certificate is revoked. The user access section also now points towards passwordless sign-in such as passkeys, which we cover in our article on passwords, MFA and passkeys.

How much does Cyber Essentials really cost?

The certificate is the cheap part. IASME's published fees run from £320 to £600 plus VAT depending on headcount, and Plus audits are quoted separately. One certification body publishes Plus prices from about £1,500 for a micro business to about £4,500 for a large one, plus VAT (Fig Group, 2026). Treat that as a market guide, not a fixed price.

The bigger cost is fixing what fails. Example: a 25-person contractor with an office in Glasgow and staff on sites across the Central Belt. It pays the small-organisation fee of £440 plus VAT. Before it can pass, it has to replace four laptops still on Windows 10, switch on MFA in its accounting and estimating software as well as Microsoft 365, remove admin rights from 11 users who install their own apps, and bring site tablets under device management so they can be patched within 14 days. None of that is unusual, but the laptops alone cost more than the certificate, and the work takes planning. Budget for remediation first, then the assessment.

How long does it take?

If your IT is already well managed, not long. IASME says the questionnaire takes about an hour once you have the answers ready, and most assessors return a result within three working days. If you fail on a minor point you get two working days to fix it and resubmit at no extra charge, and your assessment account stays open for six months.

In practice the timeline depends on the gap. A business with managed devices and MFA already switched on can often certify within two to three weeks. One with unsupported software, shared logins and unmanaged mobiles should allow six to ten weeks, most of it spent on fixes. Plus must follow within three months of the basic certificate, so book the audit when you apply, not after.

Who needs Cyber Essentials?

It isn't a legal requirement, but it is a commercial one for a growing number of businesses. Central government contracts that involve personal data or OFFICIAL information require Cyber Essentials (or equivalent controls) under Procurement Policy Note 09/23. In Scotland, public bodies decide case by case: the Scottish Government's supplier cyber security guidance asks buyers to set proportionate requirements, and they can accept a commitment to certify by an agreed date instead of a certificate on day one. Principal contractors, housing associations, local authorities and insurers increasingly ask for it too.

If you work in construction, it's covered in more depth in our construction guide's cyber security chapter. Charities can find the data protection angle in the charity technology guide.

Cyber Essentials readiness checklist

Work through these before you pay for an assessment. Anything you can't answer "yes" to with evidence is a job to do first.

How Indigo does this. Indigo Unified Communications is itself Cyber Essentials certified (IASME, valid to 27 February 2027) and Cyber Essentials Plus certified (IASME, audited, valid to 6 May 2027), and holds ISO 27001:2022. From our Glasgow and Livingston offices we review your set-up against the five controls, fix the gaps (usually MFA, unsupported software and admin rights) and prepare you for the submission and the Plus audit. Cyber Essentials support is included in Platinum, and any business can buy it separately. Cyber security and Cyber Essentials →

What to do next

1. Decide the level. Check your tenders and contracts: does the buyer ask for Cyber Essentials or Plus, and by what date?
2. Agree the scope. List every device, user, cloud service and legal entity. Cloud services can no longer be left out.
3. Run the checklist above and cost the fixes, especially unsupported devices and MFA gaps.
4. Apply once the fixes are done, and book any Plus audit within the three-month window.
5. Diary the renewal. Certificates last 12 months, and Plus lapses if the basic certificate does.