Definition
Cyber Essentials
A UK government-backed baseline cyber security certification.
Cyber Essentials is a UK government-backed certification scheme covering basic technical controls that protect organisations against common cyber attacks. Many public sector contracts, particularly those involving government data or IT systems, require suppliers to hold Cyber Essentials or the more rigorous Cyber Essentials Plus.
What the certification covers
Cyber Essentials assesses five technical control areas: firewalls, secure configuration, user access control, malware protection, and security update (patch) management. Basic Cyber Essentials is a self-assessed questionnaire verified by an accredited certification body, while Cyber Essentials Plus adds an independent technical audit and vulnerability testing of the organisation's systems.
Who needs it and how long it takes
Government policy has required Cyber Essentials for suppliers handling certain types of government data or connected to government IT networks since 2014, and many other public buyers now specify it as a minimum requirement regardless of contract value. Basic certification is usually achievable within a few weeks for an organisation with reasonably good IT hygiene already in place, while Cyber Essentials Plus takes longer due to the on-site or remote technical audit.
- Basic Cyber Essentials: self-assessment questionnaire, typically a few weeks turnaround
- Cyber Essentials Plus: adds independent technical testing, usually several weeks to a few months
- Certification is valid for 12 months and must be renewed annually
- Evidenced in tenders via the certificate number and expiry date, sometimes uploaded as supporting documentation
Frequently asked questions
- Is Cyber Essentials mandatory for all public sector tenders?
- No, but it is commonly required for contracts involving government data, IT services, or connections to public sector networks, and increasingly requested more broadly. Always check the specific selection questionnaire, as requirements vary by buyer and contract type.
- What is the difference between Cyber Essentials and Cyber Essentials Plus?
- Basic Cyber Essentials relies on a self-assessed questionnaire verified by a certification body, while Cyber Essentials Plus requires an independent technical audit of the organisation's systems. Plus is generally required for higher-risk contracts and takes longer and costs more to achieve.
- How much does Cyber Essentials certification cost?
- Costs vary by certification body and organisation size, with basic Cyber Essentials generally the more affordable option and Plus costing more due to the technical assessment involved. Suppliers should get quotes directly from accredited certification bodies for an accurate current price.
Related terms