Choose the assessment you need
Cyber Essentials is a UK government-backed certification scheme. The basic level uses a verified self-assessment. Cyber Essentials Plus starts with the same control requirements and adds an independent technical audit. Begin with the wording of your tender, contract or customer request so you know which level and scope are required.
Under IASME’s Cyber Essentials Plus guidance, the technical audit must be completed within three months of the most recent Cyber Essentials certification. Build that window into your assessment plan.
Set an honest scope
Identify the legal entity, locations, user devices, servers, cloud services and remote working arrangements included in the assessment. Record externally managed services and agree which party is responsible for each control. An excluded network or system needs a clear boundary that meets the scheme requirements.
For example, staff may work from managed laptops but access company mail from another device. Check those access paths before completing the questionnaire. Keep the scope description and asset inventory together so reviewers can understand what the answers cover.
Prepare the five controls
- Firewalls. Identify internet-facing services, rules and who approves exceptions.
- Secure configuration. Review default accounts and settings, unused services and how devices are locked before they can access organisational data.
- Security update management. Use supported software and enable automatic updates where possible. Under v3.3, apply fixes within 14 days of release when the vendor rates the risk high or critical, the CVSS v3 base score is at least 7, or the vendor supplies no severity information.
- User access control. Record how accounts are approved, privileges limited and access withdrawn. For cloud services, implement MFA where available and check its use across all relevant accounts.
- Malware protection. Select a scheme-supported protection method appropriate to each in-scope device. Confirm that the protection is enabled and operating.
Keep the NCSC requirements for IT infrastructure, v3.3 alongside your assessment and check which version applies to your application.
What a certificate tells a customer
A certificate shows that the organisation met the scheme requirements for the stated scope and level. It gives customers a specific piece of assurance to review. It does not determine a firm’s insurance premium or establish compliance with privacy legislation.
For some public contracts, buyers may require Cyber Essentials, Plus or equivalent controls where relevant and proportionate. Read the government procurement policy note and the specific tender before choosing the assessment.
If your board needs a broader view of security governance and capability across the organisation, compare the cyber maturity assessments.
Prepare, submit and maintain the controls
- Assign responsibility. Give each technical control an owner. Agree who will make the senior management declaration and who will coordinate assessor questions.
- Check the answers. Review representative settings and support records. If an answer depends on a supplier, obtain evidence covering your environment.
- Address gaps. Record missing evidence, apply fixes and confirm that the controls work before submission. For Plus, arrange the technical testing window with the assessor.
- Plan renewal. Certification is valid for 12 months. Record material changes in the meantime and plan the next assessment before expiry.
