How We Got Cyber Essentials Certified in 2026

Why we needed it

Like most early-stage startups, we were just doing our thing. No compliance framework, no risk register, barely any policy documents. We weren't ignoring security - we just hadn't got around to formalising anything. Classic founder problem.

Then we started talking to a big potential customer in a regulated space. Part of their procurement process was a due diligence questionnaire - they sent over a fairly comprehensive Google Sheet asking about our security posture. Did we have a cybersecurity policy? A risk register? An acceptable use policy? Were we doing continuous security training for employees?

And then there it was: do you have Cyber Essentials? We don't work with suppliers who don't have Cyber Essentials at a minimum.

That Google Sheet was the wake-up call. We had to get this sorted.

(Quick aside: the training question also caught us out, and we ended up signing up for a third-party platform just to tick that box. That's a different blog post, but it's actually what eventually led me to build FwdCheck. Spoiler: it was painfully boring.)

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme built around five technical controls that protect organisations against the most common internet-based threats: firewalls, secure configuration, user access control, malware protection, and software updates. It's not an audit. It's a self-assessment - you answer a questionnaire about your setup, a qualified assessor reviews your answers, and if you pass, you get certified.

There's also a higher tier called Cyber Essentials Plus, which adds hands-on technical verification of your systems. For most small companies starting out, the base cert is what you need and what customers will be asking for.

Certification is valid for 12 months, so it's an annual exercise.

One thing I didn't know until I went through the process: UK companies with a turnover under GBP 20 million automatically get free cyber liability insurance up to GBP 25,000 included with certification. After everything you've put in to get there, you've well and truly earned it.

NCSC vs IASME - what's the difference?

The NCSC - the National Cyber Security Centre - created and owns the Cyber Essentials scheme. IASME (the Information Assurance for Small and Medium Enterprises consortium) is the sole partner managing the certification network on the NCSC's behalf. In practice, IASME accredits the certification bodies that actually assess you.

So the chain is: NCSC creates the standard -> IASME manages the scheme -> accredited certification bodies assess you -> you get certified.

Pricing is set by IASME and tiered by company size. For a company of 10-49 people you're looking at around GBP 400-440 + VAT for the base assessment. Most providers add a support package on top if you want help filling things in.

Cyber Essentials evolves - and it's worth keeping up

Each year the scheme is updated to keep pace with the changing security landscape. IASME names each version after a tree - the 2025 update was called Willow, and the 2026 update is called Denzil.

The Willow update introduced stricter requirements around passwordless authentication and tightened several of the existing controls. Denzil goes further. The headline changes for 2026 are mandatory MFA across the board, a strict 14-day patching window, and - probably the most significant change - a new formal definition of cloud services that means they can no longer be excluded from your assessment scope if they process organisational data. Previously you could carve out certain cloud tools. That door is now closed.

There's also almost certainly going to be an update addressing AI usage at some point in the not too distant future. The scheme has always moved with the threat landscape, and AI introduces enough new attack surface that it would be surprising if it didn't make it into a future version. Something to watch.

The elephant in the room: you're paying people to mark their own homework

Here's the thing that left a slightly bad taste in my mouth - not because of the money, but just because of the sheer absurdity of it.

Most certification bodies offer a support package where you pay for an hour or a half day of a consultant's time to help you fill in the answers. The same consultant then assesses whether those answers pass. So you're paying them to tell you what to write, and then paying them to say it's correct.

I'm not saying it's corrupt - it's just a funny system. And the thing is, it was so easy. Once I'd done the work to get our documentation together, most of the answers basically wrote themselves.

So my honest advice: don't lean on that paid support until you've done the work yourself first.

The process: how I actually did it

Step 1: Generate your policy documents first

The first thing I did was work through the customer questionnaire and identify all the policy documents they were asking about. Cybersecurity policy, acceptable use policy, risk register, incident response plan - all things we didn't have.

Rather than downloading templates off the internet - which are almost always overkill and written for companies with dedicated IT departments - I had a conversation with an AI. I'd ask it: what is this document, why do I need it, and what would you want to know about our company to generate something that fits a team of 15-25 people? Then I'd let it ask me questions and we'd go back and forth until the document felt right. The key instruction I gave was: we don't want to make promises we can't keep, but we do want something that's robust and defensible.

We went through that process for every document the questionnaire asked about. Then I got sign-off from the leadership team - a few minor tweaks - and the documentation was sorted.

Step 2: Use those documents as your source of truth for the assessment

Once the policy documents were signed off, I created a new project in Claude and uploaded all of them. This is the smart bit: there's a huge amount of overlap between your policy documents and the Cyber Essentials questions. If you've written your policies properly, you've already answered most of the assessment.

I then went through the questionnaire section by section, using those documents as my source of truth to generate answers. Around 85 questions in total. Fewer than 10 came back as non-compliant on the first submission.

Step 3: Two attempts - use them wisely

This is important: you only get two submission attempts before you have to pay for a new assessment. So don't just blast through it carelessly.

Do your first attempt properly but don't panic if things come back wrong. You'll get feedback on whatever is non-compliant. Then use your second attempt to fix it. Only pay for the consultant's time once you know exactly which questions need addressing - that way an hour is actually enough.

Step 4: Watch out for consistency - and know which questions are strictly assessed

One thing that catches people out is consistency across your answers. If you say something in one question that contradicts something in another, you can fail - not because either answer is necessarily wrong, but because they don't line up. It's easy to do when you're pulling from different sections of different documents.

It's also worth knowing that not all questions carry the same weight. Some are assessed quite strictly - a borderline answer won't get through. Others have a bit more flexibility in how the assessor interprets your response. You won't know which is which until you've been through it once, but going in aware of that dynamic helps you think about where to invest your effort and where to be especially precise with your wording.

And don't be embarrassed if some of the things you get wrong are simple administrative questions - formal legal name of the business, that kind of thing. It happened to us.

Step 5: You can contest mistakes

On my second submission, one question came back as non-compliant. Brief panic. Then I read the feedback properly and realised there had been an error in the assessment. I contested it without having to pay for another full assessment. If something doesn't look right, push back. You're allowed to.

We passed. We won the contract.

Certified on the day of the second submission. Won the contract shortly after.

Total cost including the hour of consultant time: a few hundred quid. And honestly, less work than I expected - because we'd done the documentation properly first and used AI to work through the questions systematically.

The harder question is what comes next. Having the policies is one thing. Actually following them at a company of 15-25 people is another challenge entirely. But that's a different blog post.