What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five technical controls; Cyber Essentials is a verified self-assessment, Cyber Essentials Plus adds independent technical testing of those controls.

How long does certification last?

Certification is valid for 12 months from the date it is awarded, and is renewed annually.

What systems and devices need to be included?

All devices and services within the applicant-defined scope that connect to the internet or hold organisational data, including cloud services, laptops, mobile devices and firewalls.

Can we exclude part of the organisation?

Yes, scope can be defined at whole-organisation or sub-set level, provided any excluded part has no network path to the certified scope, and boundaries are clearly documented.

What happens if our assessment does not pass first time?

Applicants can review and resubmit answers; Cyber Essentials Plus assessments usually allow a limited remediation and re-test period before requiring resubmission.

Do we need Cyber Essentials for government contracts?

Some UK government contracts and supply chains require it, particularly for certain data types, but it is not a universal requirement across all public-sector work.

Does certification include cyber insurance?

No. Some insurers view Cyber Essentials favourably, and IASME bundles limited cover with certain certifications, but certification itself is not insurance.

Can YDC help us fix issues before submission?

Yes, YDC reviews current arrangements against the five controls and helps close gaps before the verified assessment is submitted.

Cyber Essentials certification

Achieve Cyber Essentials with practical support from experienced assessors

YDC helps organisations define assessment scope, prepare verified self-assessment, identify control gaps, and achieve certification without unnecessary technical overhead.

Compare certification routes

Government-backed schemeAligned with UK National Cyber Security Centre guidelines.

Five technical controlsFirewalls, secure configuration, access control, malware, patching.

Independently verifiedReviewed and confirmed by YDC's certified assessment professionals.

Annual certificationDemonstrates sustained compliance for ongoing tenders and contracts.

Best fit

For organisations needing a recognised baseline quickly, for tenders or client expectations

Typical trigger

When you need credible first external assurance, often from contract or procurement pressure

Government-Backed Assurance

Cyber Essentials

Clear your baseline certification quickly with direct guidance from experienced compliance specialists. Avoid common assessment pitfalls and verify controls before formal review.

Verified scoping

Confirm boundary parameters before submission.

5 Core controls

Firewalls, settings, access, malware, patch routines.

Direct review

Practical feedback to pass without redundant cycles.

Certification enquiry

Tell us about your organisation and preferred timeline to start.

Fixed fee review

Outcomes & Impact

What certification delivers for your organisation

Practical security improvements paired with commercial credibility.

Cyber Essentials provides a valuable security baseline to build on, but is not a complete cybersecurity or risk-management programme.

Protection

Reduce exposure to common internet-based attacks

Protect devices, accounts, and networks against automated, opportunistic threats and basic vulnerabilities.

Commercial

Meet customer and supply-chain requirements

Satisfy mandatory client procurement criteria, partner requirements, and tender questionnaires with recognised certification.

Assurance

Strengthen security questionnaire responses

Provide verified technical controls and clear operational proof when enterprise buyers review your posture.

Scale

Establish a foundation for wider assurance

Create standard baseline hygiene across systems before progressing toward frameworks like ISO 27001 or SOC 2.

Technical standardsCyber Essentials Foundation

The five core technical controls

Five essential controls built to prevent the vast majority of commodity cyber attacks. Each area works as an independent safeguard to secure your boundary and maintain verified posture.

Network boundary

Firewalls

Control the traffic allowed in and out of devices and networks, blocking unauthorised access.

System hardening

Secure configuration

Devices and software configured to reduce vulnerabilities, removing unnecessary functionality and default or weak settings.

Patch hygiene

Security update management

Keeping software and firmware up to date, applying security updates promptly to fix known vulnerabilities.

Identity & access

User access control

Assigning user accounts appropriately, limiting administrative privileges to those who need them, and removing access when no longer needed.

Endpoint defense

Malware protection

Measures such as anti-malware software or application allow-listing to prevent, detect and remove malicious software.

Ready to assess your coverage?

Review these five areas against your environment or prepare structured responses for client security reviews.

Explore certifications

Scope Definition

Understanding your assessment scope

Every cyber assessment operates within a defined technical boundary. Setting accurate scope ensures assessments reflect your real operational environment without unnecessary overhead.

Assessment boundary rule

Organisations define their own assessment scope and boundary. Any excluded part of the organisation must have no network path into the certified scope.

Hardware

Connected devices

Laptops, desktops, servers, mobile hardware, and boundary firewalls or routers that communicate with company networks.

Boundary focus: Includes all corporate and contractor endpoints with business data access.

Infrastructure

Cloud services

Hosted email systems, business cloud storage, SaaS applications, and developer hosting infrastructure holding organisational data.

Boundary focus: Covers third-party providers handling core operational workloads.

Identity

User accounts and access

Standard user logins, privileged administrator roles, multi-factor authentication controls, and credential rotation rules.

Boundary focus: Enforces least privilege and prompt offboarding of legacy access.

Maintenance

Software and updates

Supported operating systems, active application licences, security patching timelines, and unapproved software restrictions.

Boundary focus: Ensures critical vulnerabilities receive patches within specified SLA windows.

Perimeter

Remote and home working

Home office routers, remote desktop solutions, virtual private networks (VPN), and policies for hybrid team members.

Boundary focus: Applies equivalent baseline safeguards regardless of physical work location.

Need help validating your scope?

YDC helps identify network isolation lines, cloud borders, and device registers before official verification begins.

Explore certifications

MethodologyCyber Essentials

How we complete your Cyber Essentials assessment

A clear, four-stage pathway designed to uncover gaps early, answer questionnaires with precision, and avoid unexpected assessment delays.

Define the scope

Identify the organisation, systems, devices and services included in the assessment.

Boundary mapping & asset verification

Review your position

Compare current arrangements against the five Cyber Essentials controls and identify gaps before submission.

Baseline gap assessment against standards

Prepare and remediate

Help the organisation answer accurately and address issues that would prevent certification.

Targeted fixes & response refinement

Submit and certify

Assess the submitted application and help the organisation use its certification appropriately.

Verified submission & badge guidance

Advisory role and verification boundary

YDC provides advisory support and assessment. The applicant organisation remains responsible for the accuracy of its own submitted answers.

Ready to verify your Cyber Essentials readiness?

Discuss your assessment scope and timeline with our team.

View certification support

Framework selection

Choosing the right tier for your commercial goals

Both tiers evaluate identical technical security controls. Your commercial requirements, buyer scrutiny, and turnaround deadlines decide which tier fits best.

Cyber Essentials

Baseline standard

Cyber Essentials uses an independently verified self-assessment.

When to choose this

Best when you need fast turnaround and a cost-effective route to qualify for UK public sector supply chains or baseline commercial tenders.

Key parameters

Self-assessment verified by a certified assessor
Fast qualification for UK government & standard supplier portals
Minimal internal testing overhead for engineering teams

Includes full preparatory gap reviews and submission support from YDC.

Higher assurance

Cyber Essentials Plus

Cyber Essentials Plus assesses the same five technical controls but adds independent technical testing.

When to choose this

Recommended when major enterprise clients, high-scrutiny procurement panels, or regulated contracts demand hands-on technical validation.

Key parameters

Independent hands-on vulnerability scans and workstation tests
Meets high-scrutiny enterprise and defense tender requirements
Demonstrates verifiable technical enforcement to risk teams

Pre-audit simulation & testing remediation provided.

Direct framework alignment

Criteria	Cyber Essentials	Cyber Essentials Plus
Five core technical controls	Included	Included
Assessment methodology	Verified self-assessment	Auditor technical testing
Typical turnaround	Rapid (Can be same day)	Scheduled (2-4 weeks)
Primary commercial driver	Baseline compliance & cost efficiency	Enterprise contracts & heavy procurement

Explore the wider framework comparison

Certification clarity

Frequently asked questions

Practical answers to common scoping, assessment, and compliance queries for Cyber Essentials.

Need guidance defining your scope?

YDC reviews your setup against technical requirements before you submit.

Explore certification support

Certification Drivers

Why organisations pursue Cyber Essentials

Cyber Essentials provides a verified technical baseline against common internet threats. While not a replacement for comprehensive, risk-based governance, it answers specific operational and commercial triggers.

Commercial requirement

A tender, buyer or supply-chain requirement

Public sector procurement frameworks and enterprise vendor risk assessments increasingly make Cyber Essentials a non-negotiable condition to bid or maintain supplier status.

Review readiness

Operational baseline

A need to demonstrate a credible security baseline

A structured way to verify essential technical controls across firewalls, secure configuration, user access control, malware protection, and patch management.

Explore baseline support

Progression step

A first step before Cyber Essentials Plus, Cyber Assurance, or ISO 27001

A foundational assessment that builds internal discipline, reveals gaps early, and prepares teams for hands-on technical audits and broader information security standards.

View ISO 27001 path

Note: Cyber Essentials addresses fundamental technical controls and does not replace tailored risk assessments, vendor governance, or organisation-wide information security management systems.

Sustained compliance lifecycle