Cyber Essentials FAQs: Do You Need It, Cost and Timescales

Updated October 2026 for the Danzell question set (NCSC requirements v3.3).

Do I need Cyber Essentials? You need it if a customer, contract or tender asks for it, which is common for suppliers to UK central government and to larger private-sector buyers. Getting certified usually takes a few days to a few weeks, costs from £320 + VAT and lasts 12 months. For what the scheme is and how it works, see Cyber Essentials certification. Sovereign Secure is an IASME-licensed certification body, and we answer these questions every day. If yours is not covered below, get in touch and an assessor will help.

Cyber Essentials quick facts

Jump to: Do I need Cyber Essentials, and who needs it · Cyber Essentials basics · Cyber Essentials cost and pricing · What are the Cyber Essentials requirements · How do I get Cyber Essentials · How long does Cyber Essentials last · What about Cyber Essentials Plus

Do I need Cyber Essentials, and who needs it?

Do I need Cyber Essentials certification?

You need it if a customer, contract or tender asks for it, which is common in UK public sector and larger private supply chains. Many organisations also certify simply to fix basic weaknesses and show customers they take security seriously.

Is Cyber Essentials mandatory?

Not by law, but some UK central government contracts require it under Procurement Policy Note 014; see Is Cyber Essentials mandatory? for the contract rules.

Is Cyber Essentials worth it?

For most organisations, yes, and our guide to the benefits of Cyber Essentials weighs the cost from £320 + VAT against what certification opens up.

Is Cyber Essentials UK only?

It is a UK scheme and is mainly recognised by UK buyers, but organisations based outside the UK can also certify, which is useful when supplying UK customers. We certify organisations across the UK, including Cyber Essentials in London, and support international clients from offices in Los Angeles, Singapore, Dubai and Dhaka.

Does ISO 27001 replace Cyber Essentials?

Not automatically. Government guidance says ISO 27001-certified organisations do not automatically meet Cyber Essentials, because ISO 27001 scopes often leave out some of the five controls. See Cyber Essentials vs ISO 27001.

We are PCI DSS compliant. Do we still need Cyber Essentials?

If a customer asks for it, yes: they are separate schemes. The controls overlap, so PCI DSS work makes Cyber Essentials easier. As a PCI SSC-approved QSA company, we can scope both; see our PCI DSS compliance services.

Does Cyber Essentials make us GDPR compliant?

No. It evidences five baseline technical controls, which supports part of the UK GDPR Article 32 security duty, but it does not cover encryption, backups, breach handling or the rest of UK GDPR. See Cyber Essentials and GDPR.

Cyber Essentials basics

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme that shows an organisation has five basic technical controls in place to guard against the most common cyber attacks: firewalls, secure configuration, security update management, user access control and malware protection. See Cyber Essentials certification.

Is Cyber Essentials legit?

Yes. It is a UK government scheme, run for the National Cyber Security Centre (NCSC) by IASME, and only IASME-licensed certification bodies can issue certificates. You can verify any certificate, including the ones we issue, on the official certificate search.

What is Cyber Essentials certification?

Certification means a licensed certification body has assessed your answers to the Cyber Essentials self-assessment questionnaire and confirmed you meet the requirements. You receive a certificate valid for 12 months and appear on the public certificate search.

Who runs the Cyber Essentials scheme?

The scheme is owned by the UK government and overseen by the National Cyber Security Centre (NCSC). IASME delivers it through licensed certification bodies such as Sovereign Secure, which assess applicants and issue certificates.

When was Cyber Essentials launched?

The UK government launched Cyber Essentials in 2014. The requirements and question set have been updated regularly since, most recently in April 2026.

Are there different levels of Cyber Essentials?

Yes, two. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus includes everything in Cyber Essentials plus an independent technical audit of a sample of your devices and accounts.

What does Cyber Essentials cover?

Every device, network and cloud service in your chosen scope, checked against five controls. Our Cyber Essentials requirements and checklist breaks each control into the individual rules.

Is Cyber Essentials accreditation the same as certification?

For buyers, yes. Organisations are certified; people often call the certificate "Cyber Essentials accreditation". Certification bodies are the ones licensed by IASME to carry out assessments.

Cyber Essentials cost and pricing

How much does Cyber Essentials cost?

Our packages cost £320 to £750 + VAT, depending on company size and how fast you want to be assessed. Bronze matches IASME’s published fee bands. See the full Cyber Essentials cost table.

How much does Cyber Essentials Plus cost?

Cyber Essentials Plus is priced on your scope. Published UK prices we reviewed in September 2026 range from £999 to £3,999 + VAT. See Cyber Essentials Plus cost, or get a fixed quote through our scoping questionnaire.

How much does Cyber Essentials renewal cost?

The same as a first certificate: from £320 + VAT, on the same size bands. See Cyber Essentials renewal.

Is VAT included in your prices?

No. All our prices exclude VAT at the current rate.

Are there any extra charges?

Only if you need more resubmissions than your package includes: each extra one costs £100 + VAT. Budget separately for your own fixes, such as replacing unsupported software.

Does Cyber Essentials include insurance?

Yes, for eligible organisations, at no extra cost. IASME includes cyber liability cover with a £25,000 limit if you certify your whole organisation, are domiciled in the UK or Crown Dependencies, have annual turnover under £20m and opt in. See Cyber Essentials insurance.

What are the Cyber Essentials requirements?

What are the key requirements for certification?

Effective controls in five areas: firewalls, secure configuration of devices and software, security update management, user access control, and malware protection, across everything in scope. See the Cyber Essentials checklist.

What are the Cyber Essentials password requirements?

At least 8 characters with MFA, or 12 without (8 if common passwords are blocked); our Cyber Essentials password policy guide has the full rules.

Does MFA need to be on for every cloud service?

Yes, for all users and administrators on every cloud service that offers it. Since the April 2026 (Danzell) update, missing MFA where it is available is an automatic fail.

How quickly must security updates be installed?

Within 14 days of release for high-risk or critical updates, including those with a CVSS v3 score of 7 or above and those where the vendor gives no severity. This covers operating systems, applications and router and firewall firmware.

Do mobile phones need to be included?

Yes, if they access organisational data or services such as email, including personally owned phones used for work. They must run a supported operating system that receives security updates. Phones used only for calls, texts or an MFA app are out of scope. See Cyber Essentials mobile device requirements.

Are personal devices (BYOD) in scope?

Yes, if they access company email, data or business apps. They must meet the controls, or you must block them from company data. Our scoping questionnaire helps you decide.

Are cloud services in scope?

Always. Cloud services that store or process your data, such as Microsoft 365 or Google Workspace, cannot be excluded from your Cyber Essentials scope.

Can I certify only part of my organisation?

Yes, if that part is clearly separated, for example by a firewall or VLAN, and your scope description says what is excluded. Many organisations certify the whole organisation because it is simpler and more useful to customers.

What changed in April 2026?

Assessment accounts opened from 27 April 2026 use IASME’s Danzell question set, based on NCSC requirements v3.3. Missing MFA on a cloud service that offers it and late high or critical updates are now automatic fails, and Cyber Essentials Plus retests are stricter. See Cyber Essentials changes 2026.

What will change in Cyber Essentials in 2027?

Nothing has been announced yet. As of 13 October 2026, IASME and the NCSC have not published a 2027 question set, requirements version or start date, so the Danzell question set (v3.3) still applies. Our Cyber Essentials 2027 page tracks the next update.

How do I get Cyber Essentials?

How do I become certified?

Choose your company size and the package you need. We give you access to the assessment portal, you answer the questions online, and one of our assessors reviews them. If they meet the requirements, your certificate is issued. Our guide on how to get Cyber Essentials certification covers each step.

Can I see the questions before I start?

Yes. Our Cyber Essentials questionnaire page explains each section and has a free spreadsheet for drafting answers offline.

How long does Cyber Essentials take?

Preparation can take anywhere from a few days to several weeks, depending on how much needs to change. Once you submit, the review takes 1 working day on our Gold package, 2 on Silver and 3 to 5 on Bronze. Our guide breaks down how long it takes to get Cyber Essentials step by step.

How hard is it to get Cyber Essentials?

Not hard if your scope is right, every cloud service has MFA turned on and all your software is still supported; those three cause most failures. Our guide on how hard it is to get Cyber Essentials explains what to fix first.

What is the IASME portal?

The online platform where you answer the Cyber Essentials questions, get board-level sign-off, submit for assessment and download your certificate. Our IASME portal guide shows how it works.

Who will our assessor be?

A qualified assessor at Sovereign Secure, the IASME-licensed certification body that reviews your answers, takes your support call and issues your certificate, so there is no reseller in between. Our guide to the Cyber Essentials assessor explains their role.

What are the most common pitfalls?

Missing MFA on cloud services, unsupported software, updates older than 14 days, forgetting phones and cloud services in scope, and short or inaccurate answers. Our free Cyber Essentials readiness check spots them before you apply.

What happens if we fail?

You fix the issues and resubmit within your package limits: one resubmission on Bronze, three on Silver and unlimited on Gold, within the time allowed to pass. Our guide to the Cyber Essentials assessment lists the answers that fail most often and how to fix them.

Do I need a consultant for Cyber Essentials?

Not usually. Every one of our packages includes a pre-assessment check and a support call with an assessor. If you want hands-on help, see Cyber Essentials consultancy and support.

How long does Cyber Essentials last?

How long does Cyber Essentials certification last?

Twelve months from the date it is issued. See Cyber Essentials renewal for when to start.

Do I need to renew Cyber Essentials?

Yes, every year, and there is no grace period. To stay certified and listed, pass a new assessment against the current question set before your certificate expires.

Can I switch certification body when I renew?

Yes. You can renew with any IASME-licensed certification body, including Sovereign Secure, whoever issued your last certificate.

Do we get a Cyber Essentials logo?

Yes. IASME issues the logo with your digital certificate, and you may use it only while the certificate is valid; Plus holders get the Plus badge. See Cyber Essentials logo for the rules.

How do I check if a company has Cyber Essentials?

Search the company on the IASME certificate search and check the level and expiry date. Our guide to checking a Cyber Essentials certificate explains each field.

What about Cyber Essentials Plus?

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment: you answer a questionnaire and an assessor reviews it. Cyber Essentials Plus adds a technical audit, remote or on-site, in which an assessor scans your external systems, tests a sample of devices and checks MFA and admin accounts.

Can you get Cyber Essentials Plus without Cyber Essentials?

No. You need Cyber Essentials first, and the Plus audit must be completed within three months of that certificate. Our Plus price includes the basic assessment.

What does the Cyber Essentials Plus audit test?

Five test types from the NCSC test specification: an external vulnerability scan, authenticated patch scans, malware tests, an MFA check and an account-separation check. See Cyber Essentials Plus requirements.

How long does Cyber Essentials Plus last?

Twelve months, the same as Cyber Essentials. You renew the basic certificate and repeat the Plus audit each year.

Still have a question?

Call us on +44 161 523 5276 or send us a message. Ready to start? Compare Cyber Essentials packages and prices.