If you have clients in the United Kingdom — especially in the public sector, finance, healthcare or large enterprise — you have probably already seen the requirement “Cyber Essentials certified”. Unlike SOC 2, this is a genuine certification: a certificate is issued after assessment. Here is what the scheme covers, how Plus differs and how a company outside the UK, for example in Ukraine, gets certified.
What Cyber Essentials is
Cyber Essentials is a UK government-backed cyber-security certification scheme launched in 2014. It is owned by the National Cyber Security Centre (NCSC) and delivered by IASME and its network of certification bodies. Its goal is to confirm that an organisation has implemented a baseline set of measures that protect against the most common, untargeted attacks: phishing, malware, password guessing and exploitation of unpatched vulnerabilities.
The scheme is deliberately simple. It does not cover risk management, governance or business continuity the way ISO 27001 or SOC 2 do. Instead it focuses on five technical controls and requires that they are applied to every device and service in scope.
The five Cyber Essentials controls
- Firewalls. All devices and networks sit behind correctly configured firewalls; administrative interfaces are not exposed to the internet unless necessary.
- Secure configuration. Unnecessary accounts and software removed, default passwords changed, auto-run disabled, device locking configured.
- Security update management. Operating systems and applications are vendor-supported; critical and high-severity updates are installed within 14 days of release.
- User access control. Individual accounts for every user, administrative rights only where needed, multi-factor authentication for cloud services, password requirements.
- Malware protection. Anti-malware software or application allow-listing, sandboxing for untrusted code.
Since 2022 the scheme explicitly covers cloud services, home working and employee-owned devices (BYOD) wherever they access organisational data. For distributed teams this is the hardest part of preparation.
Cyber Essentials vs Cyber Essentials Plus
| Aspect | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Assessment format | Self-assessment questionnaire verified by a certified assessor | Self-assessment plus hands-on technical verification |
| What is tested | Questionnaire answers and a board-level declaration | External and internal vulnerability scans, device sampling, phishing/malware tests |
| Duration | 1–3 weeks | 1–2 months (Plus must be completed within 3 months of basic) |
| Validity | 12 months | 12 months |
| Certification fee | From a few hundred pounds, tiered by organisation size | Considerably higher; depends on device count and assessor |
| Typical requirement | Baseline for most clients | Public procurement, sensitive data, large-enterprise supply chains |
Plus cannot be obtained without the basic certification: first the self-assessment, then the technical verification, normally on the same scope.
Who needs Cyber Essentials
- Suppliers to the UK public sector. For central government contracts involving personal data or IT services, Cyber Essentials has been mandatory since 2014.
- IT outsourcing companies with UK clients. A growing number of enterprises list it in supplier requirements alongside ISO 27001.
- SaaS products sold in the UK, where the certificate is often a tender criterion.
- Companies wanting a quick, affordable security credential before investing in SOC 2 or ISO 27001.
Can a non-UK company get certified?
Yes. The scheme is not limited to UK organisations — any company worldwide can be certified if it meets the requirements. For a company in Ukraine this means:
- the questionnaire is completed in English through a certification body’s portal;
- scope covers every laptop, server, cloud service and mobile device that accesses company data — including devices of remote staff and contractors;
- for Plus, the assessor works remotely: external scanning plus sampled device checks over remote access.
The most common reasons for failure are unsupported OS or browser versions on individual devices, missing MFA on cloud services, shared administrator accounts and end-of-life software.
The preparation process
- Scoping. The whole organisation or a clearly segregated part (for example, the team serving a UK client).
- Asset inventory. Devices, operating systems, cloud services, accounts.
- Remediation. Patching, MFA, admin-rights review, mobile device management.
- Questionnaire completion and sign-off by a board member or equivalent.
- Assessor review, fixes if needed, certificate issued.
- Plus technical assessment within three months of the basic certificate.
How long it takes and what it costs
The certification fee is tiered by organisation size: for micro and small companies it starts from a few hundred pounds, more for medium and large ones. Cyber Essentials Plus costs considerably more because the assessor spends time scanning and sampling devices; the exact amount depends on device count, operating systems and the certification body. The bulk of the spend usually goes not on certification but on preparation: replacing out-of-date laptops, rolling out mobile device management, enforcing MFA across all cloud services. If basic hygiene is already in place, the basic certificate is realistic within two to three weeks.
The certificate is valid for 12 months, after which the process is repeated. Build it into the annual plan alongside policy reviews and, where applicable, the SOC 2 renewal — see our article on the SOC 2 bridge letter and continuous compliance.
Cyber Essentials alongside SOC 2 and ISO 27001
The five controls map fully onto SOC 2 Security criteria and ISO 27001 Annex A. If you are already preparing for SOC 2, adding Cyber Essentials takes minimal extra effort — it is effectively a UK-recognised confirmation of controls you already run. We offer it as part of our combined SOC 2 + ISO 27001 + GDPR + Cyber Essentials package. The reverse also works: Cyber Essentials can be a first step before moving on to a full SOC 2 readiness programme. For companies serving both the UK and the EU, see also SOC 2 and GDPR together.
Summary
Cyber Essentials is a fast, affordable and UK-recognised way to show that your basic cyber hygiene is in order. It does not replace SOC 2 or ISO 27001, but it is frequently a hard requirement for UK contracts and a sensible entry point for smaller teams.
Need Cyber Essentials or Cyber Essentials Plus for a UK client? Request a quote — we will define the scope, pre-check your devices and cloud services and guide you through certification with an accredited certification body. Service details are on our Cyber Essentials page.