Cyber Essentials Requirements for UK Businesses

Most cyber attacks on small and medium-sized businesses are not sophisticated. They exploit default passwords, missing updates, accounts without multi-factor authentication (MFA) and devices with no malware protection. Cyber Essentials sets out a short list of technical controls that defend against these common attacks, and gives you a certificate to show customers and suppliers that the basics are in place.

What is Cyber Essentials?

Cyber Essentials is a certification scheme backed by the UK government and overseen by the National Cyber Security Centre (NCSC). IASME is the NCSC's Cyber Essentials delivery partner, and assessments are carried out by independent certification bodies licensed through IASME.

There are two levels:

• Cyber Essentials: you complete an online self-assessment questionnaire, which is reviewed by a certification body.
• Cyber Essentials Plus: the same requirements, plus a hands-on technical audit of your systems by an assessor. It must be completed within three months of your Cyber Essentials certification.

Both certificates are valid for 12 months, so organisations that want to stay certified renew each year.

Who needs Cyber Essentials?

The UK government requires Cyber Essentials for many central government contracts, particularly those that involve handling sensitive or personal information or providing certain technical products and services. Many other organisations now ask their suppliers for it as well. Even without a contractual requirement, the controls are a sensible security baseline for any business.

What changed in April 2026

The NCSC and IASME review the scheme every year. Version 3.3 of the requirements applies to assessment accounts created after 27 April 2026. IASME describes most changes to the requirements document as clarifications, but some changes to how assessments are marked are significant:

• MFA on every cloud service. MFA must be used on all cloud services where it is available, whether it is free, included or a paid option. Not doing so is now an automatic fail.
• Cloud services cannot be excluded. The requirements now define a cloud service, and any cloud service that stores or processes your organisation's data must be in scope.
• Clearer scoping. Any in-scope device that can make or accept connections over the internet must meet the requirements. If you exclude part of your network, you must explain what is excluded, why, and how it is separated.
• Passwordless authentication. The user access control section puts more emphasis on passkeys and other passwordless methods.
• Backups. Guidance on backing up data has moved to the front of the document to stress its importance. It is guidance rather than one of the five controls.
• Application development. The web applications section has been renamed and now refers to the UK government's Software Security Code of Practice.

Assessment accounts created before 27 April 2026 continue with the previous question set. Once an account is created, you have six months to complete the assessment.

What is in scope

• End-user devices: desktops, laptops, tablets and mobile phones that access your organisation's data or services, including personally owned devices (BYOD). Devices used only for native calls, texts and MFA apps are out of scope.
• Home and remote working: devices used for work at home are in scope. A router your organisation supplies is in scope; other home routers are not, so those devices need their own software firewall.
• Cloud services: infrastructure, platform and software as a service, including Microsoft 365.
• Servers and network equipment: including boundary firewalls, routers and wireless devices that can communicate over the internet.

You can certify the whole organisation or a separated part of it, but you will need to justify a partial scope to your assessor.

The five technical controls

1. Firewalls

• Protect every device in scope with a correctly configured firewall (or a network device with firewall functionality).
• Change default administrative passwords to strong, unique ones, or disable remote administration entirely.
• Do not allow the administrative interface to be reached from the internet unless there is a documented business need and it is protected by MFA, or by an IP allow list combined with well-managed passwords.
• Block unauthenticated inbound connections by default. Approve and document every inbound rule, and remove rules you no longer need.
• Use a software firewall on devices that connect to untrusted networks such as public Wi-Fi.

2. Secure configuration

• Remove or disable unnecessary user accounts and software, and change default or guessable passwords.
• Disable auto-run features that execute files without the user's permission.
• Make sure users authenticate before they can access organisational data or services.
• Protect device unlocking against guessing: limit attempts to no more than 10 in 5 minutes, or lock the device after no more than 10 failed attempts.
• Where a PIN or password is used only to unlock a device, it must be at least 6 characters.

3. Security update management

• All software on in-scope devices must be licensed and supported. Remove software when it becomes unsupported, or move it out of scope.
• Turn on automatic updates wherever possible.
• Install updates within 14 days of release where they fix vulnerabilities the vendor rates as critical or high risk, where the vulnerability has a CVSS v3 score of 7 or above, or where the vendor gives no details. This includes router and firewall firmware.

Unsupported operating systems are a common reason for failing. For example, Windows 10 reached the end of support on 14 October 2025, so devices still running it need to be upgraded or replaced, or another supported option agreed with your assessor.

4. User access control

• Create and approve user accounts through a defined process, and give people only the access they need for their role.
• Use separate accounts for administrative tasks only: no email, web browsing or other everyday work from an admin account.
• Remove or disable special access when it is no longer needed, for example when someone changes role.
• Use MFA wherever it is available. Authentication to cloud services must always use MFA.
• Protect passwords against guessing with MFA, throttling or account lockout, and control password quality using MFA, a minimum length of 12 characters, or a minimum of 8 characters with automatic blocking of common passwords.
• Do not set a maximum password length, and do not enforce regular password expiry or complexity rules.

5. Malware protection

• On Windows and macOS devices, use anti-malware software that is kept up to date, stops malware and malicious code from running, and blocks connections to malicious websites.
• Alternatively, on any device, use application allow listing so that only approved, code-signed applications can run.

Common reasons organisations fail

• MFA not switched on for one or more cloud services.
• Unsupported operating systems or software still in use.
• Critical updates, including router or firewall firmware, not installed within 14 days.
• Default passwords left on routers, firewalls or other equipment (see our 10 signs your business network isn't secure).
• Staff doing everyday work from accounts with administrator rights.
• Personal phones accessing work email without a screen lock.

How to get certified

1. Decide your scope: the whole organisation, or a clearly separated part of it.
2. Check your systems against the requirements and list the gaps.
3. Fix the gaps. Microsoft 365 settings are a common starting point; see our Microsoft 365 security best practices.
4. Buy an assessment through IASME and complete the self-assessment questionnaire.
5. A certification body reviews your answers and, if you meet the requirements, issues your certificate.
6. For Cyber Essentials Plus, arrange the technical audit within three months.

IASME publishes its assessment fees, which are tiered by organisation size; check the current prices on the IASME website. Budget separately for any remediation work and, for Cyber Essentials Plus, the certification body's audit.

How Pulsar IT can help

Our Cyber Essentials support helps you scope your assessment, close the gaps and prepare your application. Certification itself is awarded by an independent certification body. Our managed IT plans cover the patching and device configuration the controls depend on, and our cybersecurity services add endpoint protection and vulnerability management. A free security review is a good first step if you are not sure where you stand.

Sources

• NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026)
• IASME, Upcoming changes to the Cyber Essentials scheme: April 2026 update