Cyber Essentials was launched in 2014 by the UK government to raise the security floor across British businesses, particularly small and medium-sized organisations that had little in-house security capability. The scheme is deliberately simple: it targets the majority of attacks rather than the advanced minority, on the evidence that most successful intrusions exploit basic gaps in the five controls, not sophisticated techniques. A large share of UK breaches could have been prevented by Cyber Essentials-level hygiene.
The five controls are specific. Secure configuration means devices and software are set up to reduce vulnerability — removing default accounts, disabling unnecessary services, changing default passwords. Boundary firewalls means internet connections are protected and rules are reviewed. Access control means users have only the access they need and administrative accounts are restricted. Malware protection means a recognised product is in place on all endpoints. Patch management means known vulnerabilities are fixed within a defined timeframe, especially for internet-facing software.
The two tiers matter. Cyber Essentials is a self-assessment: the organisation answers a questionnaire, signed off by a senior person, and is awarded the certification. It is cheap, fast, and a meaningful commitment to the baseline. Cyber Essentials Plus adds independent verification — an assessor runs vulnerability scans and a hands-on technical test to confirm the controls actually operate. For organisations bidding for government work, or whose customers demand verified assurance, Plus is often the required tier.
For many UK organisations Cyber Essentials is a procurement requirement. The UK government mandates that suppliers handling certain personal data or bidding for specified public-sector contracts hold at least the base certification, and many large private buyers apply the same standard to their supply chains. For a small business, holding Cyber Essentials is also a differentiator and a signal of operational maturity.
Passeca supports both tiers. For the base certification Passeca helps an organisation interpret the questionnaire, close the gaps the self-assessment exposes, and complete the submission correctly the first time. For Cyber Essentials Plus, Passeca runs a pre-assessment to find and fix the issues the independent assessor would otherwise flag, then coordinates the assessment itself. Either tier is often bundled with a broader control baseline that also satisfies ISO 27001 or NIS2 entry requirements.