Cyber Essentials Turned 12 This Year.
Someone at your company just decided you're the person responsible for getting Cyber Essentials certified. Maybe it was your manager. Maybe it was a contract requirement that landed in your inbox. Maybe you put your hand up without fully understanding what it involved.
Either way, you're now the accidental compliance officer, and you've spent the last hour reading NCSC guidance that assumes you already know what a "firewall" means in the context of a cloud-first company with 40 laptops and no on-premises servers.
This post is for you.
Cyber Essentials launched in 2014. The UK government had been investigating a series of attacks against large organisations and noticed something uncomfortable: the techniques being used weren't sophisticated. They were basic. Off-the-shelf exploits against unpatched software. Phishing emails that worked because no multi-factor authentication was in place. The same five gaps, over and over again.
So NCSC (or CESG as it was then) worked with industry to build a certification scheme around closing those five gaps. The logic was straightforward: if you can prove you've got these fundamentals covered, you're protected against the vast majority of attacks, because the vast majority of attacks don't need to be sophisticated when the basics are left open.
That logic still holds. Twelve years later, the controls at the heart of the scheme are recognisably the same ones. The scheme has been updated — most significantly in 2022, and again this year with the Denzil 2026 version — but not because the original thinking was wrong. It's been updated because what "your network boundary" means has changed completely. In 2014, most companies had a server in a cupboard and a router on the wall. By 2022, they had laptops at kitchen tables, files in Google Drive, and no cupboard in sight.
The five controls, translated
The official documentation describes them. What it doesn't always do is explain why each one matters in plain terms.
Firewalls. Every device that connects to the internet should have something filtering what traffic is allowed in and out. On a corporate network, that's typically a dedicated firewall. On a laptop working from a coffee shop, it's the software firewall built into Windows or macOS — but it needs to be on and configured, not just present.
Secure configuration. Devices and software should not be left with their default settings intact. Default passwords, unnecessary services running in the background, guest accounts left enabled — these are open doors. The control requires you to close them before devices go into use, not after you notice something's wrong.
User access control. People should have access to what they need, and no more. Admin accounts — the ones that can install software, change system settings, create new users — should be used only when that level of access is genuinely required. Most day-to-day work does not require admin rights, and most people have them anyway.
Malware protection. Something needs to be watching for malicious software. In 2014 that meant antivirus. In 2026 it means a broader category of endpoint protection — but the principle is unchanged. Managed, monitored, up to date.
Security update management. Software vulnerabilities get discovered constantly. Vendors release patches. Those patches need to be applied within 14 days for internet-facing software and services, or the vulnerability stays open. This one catches more organisations than any other during assessments, because "we'll get to that update" is a very common policy in practice.
What it actually involves to get certified
There are two levels: Cyber Essentials and Cyber Essentials Plus.
Cyber Essentials is a self-assessment. You answer a set of questions about your organisation's technical controls, a Certification Body reviews your answers, and if everything checks out, you get a certificate. The assessment covers the five controls above, applied to your specific scope — the devices, software, and services you've defined as in-scope for the certification.
Cyber Essentials Plus adds an independent technical verification. An assessor actually tests your controls rather than taking your word for it. It takes longer and costs more, but carries more weight for procurement purposes and supply chain assurance.
Most organisations start with CE basic. Some contracts — particularly public sector ones — require Plus. If you're not sure which you need, look at the contract or tender that triggered this. It will usually specify.
Time commitment varies more than the guidance suggests. If your IT infrastructure is well-documented and your controls are already largely in place, a week of focused effort to gather evidence and complete the self-assessment is realistic. If you're starting from scratch — no asset register, no written patch policy, admin rights handed out freely — expect several weeks of remediation before you're in a position to submit.
The certificate lasts for 12 months. Then you do it again.
The stat that doesn't get enough attention
The free cyber insurance that comes with CE certification is backed by data: organisations holding a valid Cyber Essentials certificate are 92% less likely to make a cyber insurance claim than those without one.
That's not a marketing number. That's what the actual claims data shows. It's worth sitting with for a moment. The controls are not complicated. They don't require significant investment. They're not even particularly burdensome to implement if you approach it methodically. But they cut the likelihood of a successful attack — the kind that leads to an insurance claim — by that margin.
The reason is the same one NCSC identified in 2014: most attacks don't need to be sophisticated. If you've closed the five gaps, you've removed yourself from the easy target category. Attackers go elsewhere.
The part they don't warn you about
The hardest part of Cyber Essentials for most organisations isn't the technical controls. It's the documentation.
You need to know what devices are in scope. You need to know what software is running on them. You need to be able to demonstrate that patches are being applied within 14 days. You need evidence that admin accounts are restricted, that MFA is in place for cloud services, that firewalls are configured correctly.
None of that requires sophisticated infrastructure. It does require that you've been keeping track of things, or that you're willing to do the audit work now.
If you've inherited a messy IT environment — undocumented devices, software installed informally, nobody quite sure who has admin rights to what — that's where the time goes. The questions are straightforward. The answers sometimes require excavation.
Start with an honest inventory of what you actually have. Not what you think you have. What's actually on the network, what software is running, who has access to what. From that foundation, the gaps become visible, and the path to certification becomes a list of tasks rather than a fog.
Cyber Essentials is not a perfect scheme. No certification is. But it's well-designed for what it tries to do, it's affordable, it's recognised by UK procurement teams, and the evidence suggests it genuinely reduces risk rather than just generating paperwork.
Twelve years in, it's the baseline. Not the ceiling.