Do I need Cyber Essentials? A plain-English guide

More and more businesses are being asked "are you Cyber Essentials certified?" – by customers, insurers and on tender forms. Here's what it actually is, whether you need it, what it costs and what changed in 2026.

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification, run by the National Cyber Security Centre (NCSC). It's described as the minimum standard of cyber security recommended for organisations of every size, and it's built around five technical controls that stop the most common attacks:

1. Firewalls – controlling the traffic between the internet and your network.
2. Secure configuration – setting up devices and software so there are fewer ways in.
3. Security update management – keeping software patched.
4. User access control – making sure people only have the access they need.
5. Malware protection – detecting and stopping malicious software.

There are two levels. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus checks the same controls but adds independent hands-on testing of your systems, so it gives a higher level of assurance.

Do you need it?

It's not a legal requirement for most businesses, but you're likely to need it if:

• You bid for public sector work – it's required for many central government contracts.
• Your larger customers ask their suppliers to be certified (a growing number do).
• Your cyber insurer or a lender asks how you protect your systems.
• You hold sensitive client data and want a simple way to show you take it seriously.

Even if nobody's asking yet, the five controls are exactly what most small businesses should have in place anyway.

What does it cost?

The certification fee for Cyber Essentials depends on the size of your organisation:

Cyber Essentials Plus is quoted individually because it includes testing, and some providers start from around £1,500 + VAT. There's a useful bonus too: UK organisations with a turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance, including 24/7 incident response support.

The fee is only part of the picture – the real work is getting your systems to meet the standard, which is where most businesses need help.

What changed in April 2026

The requirements were updated on 27 April 2026 with a new question set, known as "Danzell". The headline changes:

• Multi-factor authentication (MFA) is now mandatory wherever it's available. If a cloud service offers MFA and you haven't switched it on, you fail.
• All cloud services are in scope – including email, file storage and even business social media accounts. They can't be left out.
• Patching within 14 days is now an automatic fail if missed for high-risk and critical updates.
• Scope rules are tighter, so it's harder to leave parts of your network out.

In short: if you were certified before, don't assume you'll sail through renewal.

How to get ready

1. List everything – every laptop, phone, server and cloud service your business uses.
2. Switch on MFA for every account that supports it, starting with email.
3. Get patching under control – automatic updates, with nothing out of support.
4. Tidy up admin rights so everyday accounts can't install software.
5. Check firewalls and antivirus are on, managed and up to date.
6. Then apply through an accredited certification body.

This is exactly the kind of work we do for clients every day. We put the controls in place, keep them running, and make sure your systems are ready before you're assessed.