Cyber Essentials Guide

Cyber Essentials looks simple, five controls and a questionnaire, yet organisations still fail it on the same points: cloud services left out of scope, accounts without MFA, unsupported software and patches older than 14 days. The scheme is the UK government's baseline for organisations of all sizes, run by the NCSC with IASME as delivery partner, and it is a condition of many central government contracts. The requirements changed on 27 April 2026, when version 3.3 and the Danzell question set replaced version 3.2 and Willow. This guide explains the five technical controls with their actual thresholds, the scope rules for cloud, BYOD and home workers, what the Cyber Essentials Plus audit tests, procurement rules and how the scheme relates to the Cyber Assessment Framework, ISO 27001 and Australia's Essential Eight. It is written for IT managers preparing for certification, security leads using the scheme as a baseline, and buyers who require it from suppliers.

Key takeaways

• Version 3.3 is current. The NCSC's Requirements for IT Infrastructure v3.3 took effect on 27 April 2026 with the Danzell question set; it states plainly that "Cloud services cannot be excluded from scope."
• MFA is mandatory for cloud services. v3.3 says MFA is "always required for cloud services", and Cyber Essentials Plus tests MFA configuration with real user and administrator accounts.
• Fourteen days is the patching line. Updates fixing critical or high-risk vulnerabilities (CVSS v3 base score 7 or above, vendor-rated critical or high, or unrated) must be installed within 14 days of release, and unsupported software must go.
• User access control is an identity control. Account approval, unique credentials, leaver removal, separate administrator accounts with no email or browsing, and MFA cover most of the scheme's identity expectations, including accounts used by MSPs.
• It is a baseline, not a programme. Cyber Essentials does not cover backups, logging, detection or incident response; pair it with the CAF, ISO 27001 or the Essential Eight where risk demands more.

The scheme and its current version

The NCSC describes Cyber Essentials as "the minimum standard of cyber security recommended by the Government for organisations of all sizes", built around five controls that prevent the most common internet-based attacks. The NCSC publishes the technical requirements; IASME, the official delivery partner, publishes the question set, runs the certification platform and manages a network of more than 400 organisations that help with certification. Question sets carry names, and each maps to a requirements version.

Always check the NCSC resources page before an assessment: the question set your application starts on decides which requirements apply.

Cyber Essentials and Cyber Essentials Plus compared

The NCSC also states that organisations with turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance arranged by IASME. See the Cyber Insurance Guide.

Scope: what must be included

The scope can be the whole organisation or a well-defined, separately managed sub-set with a stated business unit, network boundary and location, agreed with the certification body. Whole-organisation scope is recommended, and "A scope that doesn't include end-user devices isn't acceptable." Devices and software are in scope if they can receive connections from internet-connected devices, make outbound connections via the internet, or control data flows between the two.

• Cloud services: any cloud service holding or processing organisational data or services is in scope and, under v3.3, cannot be excluded. The applicant stays responsible for every control even where the provider implements some of them.
• BYOD: personally owned devices that access organisational data or services are in scope. Devices used only for native voice, native text or MFA apps are out of scope.
• Home and remote workers: their corporate or BYOD devices are in scope. A router the organisation supplies is in scope; the worker's own ISP router is not, so a software firewall on the device must provide the boundary. With a corporate VPN, the boundary becomes the corporate, virtual or cloud firewall.
• Third parties: all accounts the organisation owns are in scope, including those used by suppliers, contractors and managed service providers. Their own devices are out of scope, but organisation-owned devices loaned to them are in.
• Servers, network devices and thin clients: all count as devices; firmware on firewalls and routers counts as software and must be supported and patched.
• Unsupported systems: legacy devices can only leave scope inside a sub-set that blocks all traffic to and from the internet.

The five technical controls

Firewalls

• Coverage: every in-scope device sits behind a correctly configured firewall or network device with firewall function; devices on untrusted networks such as public Wi-Fi need a software firewall (Windows Defender Firewall, macOS application firewall).
• Administration: change default administrative passwords or disable remote administration. Do not expose the management interface to the internet unless there is a documented need; if you must, protect it with MFA or an IP allow list plus managed passwords.
• Rules: block unauthenticated inbound connections by default; inbound rules must be approved and documented by an authorised person with the business need; remove rules that are no longer needed. See the Firewall Management Guide.

Secure configuration

• Remove what is not needed: guest accounts, unused administrator accounts, unnecessary applications, utilities and network services. Change default or guessable passwords and disable auto-run.
• Device unlocking: biometric, password or PIN before access, with throttling of no more than 10 guesses in 5 minutes or lockout after no more than 10 failed attempts. A credential that only unlocks the device needs at least 6 characters; if it also authenticates to services, the user access control password rules apply.

Security update management

• Licensed and supported: all in-scope software, including operating systems, applications and router or firewall firmware. Unsupported software must be removed.
• The 14-day rule: install updates within 14 days of release where the vendor rates the fix "critical" or "high risk", the CVSS v3 base score is 7 or above, or the vendor gives no severity. If a bundled update contains any such fix, the whole update is due within 14 days. Applying all updates within 14 days is recommended, not required.
• Automatic updates: enable them wherever possible. See the Patch Management Guide.

User access control

• Lifecycle: a process to create and approve accounts; unique credentials for each user; remove or disable accounts when no longer needed (leavers, defined inactivity); remove special privileges after a role change.
• Administrator separation: administrative work uses separate accounts that are never used for email, web browsing or other standard activities.
• MFA: use MFA wherever available; it is always required for cloud services and should protect administrative and internet-accessible accounts. The password element needs at least 8 characters with no maximum. FIDO2 authenticators count as MFA; SMS is described as weaker but better than none.
• Password-only systems: brute-force protection (MFA, throttling at 10 guesses in 5 minutes, or lockout after 10 failures) and password quality (MFA, at least 12 characters, or at least 8 characters with an automatic deny list of common passwords). No enforced expiry or complexity rules; change passwords promptly on suspected compromise.

Malware protection

• Anti-malware software: for in-scope Windows and macOS devices, including servers; updated per vendor guidance, and configured to stop malware running, block malicious code and prevent connections to malicious websites.
• Application allow listing: available for any device type; only approved, code-signed applications run and users cannot install unsigned or invalidly signed applications. See the Application Allowlisting Guide.

Cloud services and shared responsibility

v3.3 sets out who normally implements each control by service model. The applicant must still show that every control is met, using the provider's contract or documentation where the provider does the work.

User access control is always the applicant's job, which is why SaaS tenants are where most cloud failures occur: a CRM, finance or file-sharing service bought by a department, with local accounts and no MFA. LRQA, a certification body, reported in February 2026 that under Danzell a missing MFA on a cloud service where it is available fails the whole self-assessment. The Snowflake breach showed the consequence: infostealer credentials worked on customer accounts that had no MFA.

Where identity fits

Most of what an assessor checks under user access control is identity hygiene. Practical points that applicants miss:

• Inventory accounts per service: list every cloud tenant and its local accounts, including break-glass and integration accounts, and confirm each has an owner. See the SaaS and OAuth App Governance Guide.
• Third-party administrators: MSP and contractor accounts are in scope and must meet MFA and separation rules. See the Third-Party Access Guide.
• Daily-use admin rights: users who are local administrators on their laptops and also read email fail account separation. Remove local admin or provide separate accounts; see the Endpoint Privilege Management Guide.
• Phishing-resistant options: FIDO2 security keys and passkeys meet the MFA requirement and remove password-reuse risk. See the MFA Guide.

What the Cyber Essentials Plus audit tests

Devices are sampled using the delivery partner's method, so standard builds reduce effort. Any failed sub-test fails the assessment, although the specification lets the assessor consult the delivery partner where deviations are marginal (under 5% of tests performed). LRQA reports that under Danzell, assessors retest failing devices and an additional sample, and the self-assessment must be final before Plus testing starts.

Government contracts and procurement

PPN 014, published by the Cabinet Office on 17 February 2025 and effective from 24 February 2025, replaced PPN 09/14 and PPN 09/23 for procurements under the Procurement Act 2023. It applies to central government departments, executive agencies, non-departmental public bodies and NHS bodies, and targets contracts that handle citizens' or government employees' personal information, or supply ICT systems that process OFFICIAL information. Buyers specify Cyber Essentials or Cyber Essentials Plus according to risk, and the certificate "must be renewed annually by the supplier for the duration of the contract". Under section 56 of the Act, equivalent controls must be accepted, normally verified by an independent third party, and the note says the scheme "should not be applied to all contracts as a matter of course". Procurements begun before 24 February 2025 still follow PPN 09/23. IASME also notes that Ministry of Defence suppliers need certification throughout supply chains that handle defence information.

Choosing a level and an approach

• CE or Plus: choose Plus when a contract demands it, when you need to prove controls work (insurers, enterprise customers), or when your environment is large enough that self-assessed answers are unlikely to hold everywhere.
• Whole or sub-set scope: small organisations should certify everything; it is simpler and qualifies for the included insurance. Large organisations may start with a sub-set, but it must include end-user devices and cloud services and be separately managed, and a sub-set certificate tells customers little about the rest of the estate.
• Anti-malware or allow listing: anti-malware is easier on general-purpose Windows and macOS fleets; allow listing suits kiosks, servers and mobile platforms where store signing already applies.
• Small organisations: use the NCSC Readiness Tool and the free 30-minute consultation with an NCSC-assured Cyber Advisor before paying for assessment.

Getting certified: a phased approach

1. Download the current question set from IASME and read it against v3.3, noting which question set your application will start on.
2. Define scope: inventory devices, cloud services, BYOD and third-party accounts; agree any sub-set boundary with your certification body early.
3. Close the identity gaps first: enforce MFA on every cloud service (Conditional Access or provider equivalent), remove dormant accounts, split admin accounts and remove local admin rights. Pilot MFA with IT staff, then roll out in rings, keeping break-glass accounts documented.
4. Fix updates and unsupported software: turn on automatic updates, replace end-of-life systems or isolate them in a no-internet sub-set, and measure time to patch against 14 days.
5. Harden firewalls and configuration: review inbound rules with owners, close internet-exposed management interfaces, apply baseline builds.
6. Test before the assessor does: run your own external scan and authenticated scans of a sample; for application allow listing, run in audit mode before enforcing, and keep a rollback policy ready if business applications break.
7. Submit and sign off: complete the self-assessment with evidence and board sign-off, then book Plus testing within the window if required.
8. Keep it live: track the controls monthly rather than once a year before renewal.

Measuring that the controls hold

• Patch latency: percentage of critical and high fixes installed within 14 days, by device class (target 100%).
• Unsupported software count: in-scope devices running end-of-life operating systems, applications or firmware (target zero).
• Cloud MFA coverage: cloud services and accounts, including third-party accounts, without enforced MFA (target zero).
• Admin separation: users with local or tenant administrator rights on their daily account (target zero).
• Dormant accounts: enabled accounts with no sign-in for 90 days or belonging to leavers.
• Firewall rule hygiene: inbound rules without a documented owner and business need.

Log sign-ins without MFA, failed patch deployments and new inbound rules so drift is visible between certifications.

Common failure patterns

• Forgetting SaaS: shadow cloud services with local accounts and no MFA, now an automatic problem under v3.3.
• Remote access without MFA: the Change Healthcare breach began with a remote access login that had no MFA, exactly what the user access control and Plus test case 4 target.
• End-of-life operating systems left in scope: one unsupported build fails the assessment; plan replacements before renewal.
• Firmware ignored: routers, firewalls and VPN appliances are software too and must be within 14 days on critical fixes.
• Annual compliance only: controls drift after certification, so the certificate stops describing reality within months.
• Answers the signatory never read: the board declaration makes inaccurate answers a governance issue, not just a technical one.

How Cyber Essentials relates to other frameworks

Framework mapping

Mappings are topical, not formal equivalences; check the specific requirement before claiming coverage. See the Control Mapping Guide.

Practitioner checklist

• Confirm which requirements version and question set your assessment will use (v3.3 Danzell from 27 April 2026).
• Inventory every cloud service and bring it into scope with MFA enforced for all users, including third parties.
• Remove or isolate all unsupported software and firmware.
• Prove critical and high updates land within 14 days, with automatic updates on.
• Separate administrator accounts and remove local admin rights from daily-use accounts.
• Review inbound firewall rules and remove internet-exposed management interfaces.
• Confirm anti-malware or allow listing on every in-scope device.
• Run your own external and authenticated scans before a Plus audit.
• Track the controls monthly and renew every 12 months.

Standards and references

• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3
• NCSC: Cyber Essentials Plus Test Specification v3.2
• NCSC: Cyber Essentials Overview
• NCSC: Cyber Essentials Resources
• Cabinet Office: PPN 014 Cyber Essentials Scheme
• IASME: Cyber Essentials Frequently Asked Questions
• NCSC: Cyber Assessment Framework
• LRQA: Cyber Essentials changes, Danzell question set released

Related NHI Mgmt Group resources: Essential Eight Guide · MFA Guide · Patch Management Guide · ISO 27001 Certification Guide · Privileged Access Management Guide