Cyber Essentials

What it means

Cyber Essentials is a UK government-backed certification scheme, run with the National Cyber Security Centre, that shows an organisation has put basic protections in place. It focuses on five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.

There are two levels. Cyber Essentials is a self-assessment that a certification body reviews. Cyber Essentials Plus adds a hands-on technical check by an assessor. The idea that makes it click: it targets the common, low-effort attacks that most organisations still fall to, not advanced ones.

Why it matters

The scheme has become a practical gate for selling in the UK. Some public sector contracts that handle sensitive or personal information require it, and many private buyers now ask for it. A certificate gives them a short answer in place of a long questionnaire.

It is not a test of your product. Certification covers your organisation's devices and networks, so a certified company can still ship an application with serious flaws. Treat it as a baseline for how your company runs, and look elsewhere for assurance about the software you sell.

How it shows up

It shows up in procurement documents, tenders and supplier questionnaires, often as a required certificate before a contract. Within the company, it means a review of laptops, servers, cloud services, firewalls and accounts: who has admin rights, whether updates are applied in time, and whether multi-factor authentication is on.

Mistakes repeat: leaving out a cloud service or a set of personal devices from scope, relying on old software that no longer receives updates, and treating the certificate as proof of product security. For the product itself, a penetration test and patch management carry the weight. Compare with ISO 27001.