Cyber Essentials Plus

Cyber Essentials is the UK government-backed baseline cybersecurity certification, owned by the National Cyber Security Centre and delivered by IASME as the sole delivery partner. It covers five technical control themes: firewalls, secure configuration, security update management, user access control, and malware protection.

The basic level is a verified self-assessment: the applicant answers the current question set ("Willow", version 3.2, introduced April 28, 2025, replacing "Montpellier") and a certification body reviews and signs off the answers.

Cyber Essentials Plus adds independent technical verification: an assessor from a licensed certification body tests a sample of devices and the internet-facing perimeter (vulnerability scans, patch checks, malware protection tests, email and browser download tests, multifactor authentication checks, and account separation checks) within three months of the basic certificate.

In writing, an applicant needs a defined scope (the whole organization or a clearly separated subset), an asset list of in-scope devices, cloud services, and network equipment, documented configuration and patching standards showing the fourteen-day rule for critical and high updates, an account management procedure covering joiners, movers, leavers, administrative accounts, and MFA, a malware protection approach for each device type, and a policy for home and remote working and bring-your-own-device.

Public sector contracts under PPN 014 and many private supply chains require it, and certification comes with included cyber insurance for small UK organizations.