Cyber Essentials Certification
For UK organisations seeking the government-recognised baseline of technical controls against common cyber attacks — often a public-sector contract prerequisite.
Cyber Essentials is the UK government-backed scheme that certifies a baseline of five technical controls against common cyber attacks, administered by IASME on behalf of the NCSC. Passeca defines your boundary, closes the five controls, completes the self-assessment, and supports the hands-on technical verification for Cyber Essentials Plus — the fastest certification in the Passeca framework set.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme that defines a baseline of technical controls to protect organisations against the most common types of cyber attack. It is owned by the National Cyber Security Centre (NCSC) and administered by the IASME Consortium on its behalf.
The scheme rests on five technical controls. At the Cyber Essentials level, an organisation self-assesses against the controls and a certification body verifies the answers. At Cyber Essentials Plus, an independent assessor conducts hands-on technical verification — vulnerability scans and a test of a sample of devices — to confirm the controls genuinely operate. Certification is valid for 12 months and is a requirement for many UK central-government contracts involving personal data or ICT services.
Who needs Cyber Essentials?
- You bid for UK government contracts. Cyber Essentials is mandated for many central-government contracts handling personal information or ICT services.
- You are in a UK public-sector supply chain. Prime contractors frequently require it of their suppliers.
- You want a defensible cyber baseline. The five controls block the large majority of common, commodity attacks.
- An insurer or customer asked for it. Some cyber insurers offer better terms to certified organisations.
What does Cyber Essentials actually require?
Cyber Essentials requires five technical controls to be in place across the whole of the organisation's defined boundary. The controls are intentionally pragmatic — they target the attacks that account for the majority of incidents.
- Firewalls — secure your internet connection with a properly configured boundary device, change default passwords, and restrict inbound and outbound traffic.
- Secure configuration — set computers and network devices to a secure baseline, remove or disable unnecessary software and accounts, and change default passwords.
- User access control — grant each user only the access they need, use unique accounts, and protect privileged accounts with additional controls such as MFA.
- Malware protection — deploy anti-malware on all devices that connect to or from the internet, and keep it current.
- Security update management — patch all software and operating systems within 14 days of release for high-severity and critical vulnerabilities, and remove end-of-life software.
For Cyber Essentials Plus, an assessor verifies these controls technically — including scans and a hands-on test of a sample of devices — to confirm they actually operate, not just that they are documented.
How Passeca helps you achieve Cyber Essentials certification
- 01
Scope definition
We define the boundary of your organisation and the internet-connected devices, software and services it covers. Getting the boundary right is what makes the five controls verifiable and the certification defensible.
- 02
Gap analysis against the five controls
We assess your environment against the five Cyber Essentials controls — firewalls, secure configuration, user access control, malware protection and security update management — and identify the gaps.
- 03
Remediation
We close the gaps with you — hardening configurations, enabling MFA, verifying patching coverage, confirming boundary defences. For Cyber Essentials Plus we ensure the environment is ready for the hands-on technical verification.
- 04
Self-assessment (Cyber Essentials)
We complete the Cyber Essentials questionnaire with you, answer every question accurately with evidence, and submit it to your chosen certification body for assessment.
- 05
Technical verification (Cyber Essentials Plus)
For Plus, an assessor conducts hands-on technical verification — internal and external vulnerability scans and a hands-on test of a sample of devices. We support you through the assessment and remediate any findings.
What you get from the engagement
How long does Cyber Essentials certification take?
| Level | Typical duration | What drives it |
|---|---|---|
| Cyber Essentials | 1–2 months | Closing the five controls and completing the self-assessment |
| Cyber Essentials Plus | 2–4 months | Cyber Essentials first, then hands-on technical verification |
Cyber Essentials is the fastest certification Passeca delivers. The main variable is patching and configuration coverage across the estate; a greenfield estate can sometimes certify in weeks.
Doing more than one framework?
| Cyber Essentials | ISO 27001 | SOC 2 | |
|---|---|---|---|
| Firewall / boundary | CC6 | ||
| Secure configuration | |||
| Access control / MFA | |||
| Malware protection | CC7 | ||
| Patching (14-day rule) | |||
| Management system / ISMS | No | Implicit | |
| Depth | 5 controls | 93 controls | TSC |
Cyber Essentials is a subset of ISO 27001 and SOC 2 — the five controls map directly into both larger frameworks. It is an excellent first step that becomes the technical foundation for a later ISO 27001 or SOC 2 journey. Passeca builds the evidence once.
Cyber Essentials, answered
The questions UK organisations ask before starting Cyber Essentials.
What is Cyber Essentials?
Who needs Cyber Essentials?
What is the difference between Cyber Essentials and Cyber Essentials Plus?
What are the five Cyber Essentials controls?
How long does Cyber Essentials certification take?
Is Cyber Essentials a government-contract requirement?
How long is Cyber Essentials valid for?
The fastest cybersecurity certification you can earn
Book a free compliance consultation. We'll help determine which certification level suits your needs, discuss your scope, and outline an indicative timeline.
Related