Reviewed and updated on 20 October 2026.
Cyber Essentials gives organisations a defined set of technical security controls to work towards. It can help businesses address common weaknesses and demonstrate security measures to customers and suppliers.
The five control areas
The NCSC’s scheme overview identifies firewalls, secure configuration, security update management, user access control and malware protection.
Cyber Essentials uses a verified self-assessment. Cyber Essentials Plus adds technical testing. Both concern the same five control areas, with different levels of assurance.
What to prepare
- An accurate inventory: devices, operating systems, applications and cloud services.
- A clear assessment scope: which parts of the organisation and systems are included.
- A list of gaps: unsupported software, overdue updates, unnecessary access or insecure settings.
- Owners and dates: who will address each issue and provide the evidence.
Use the current scheme requirements for your assessment. Resolve gaps before submitting answers, and check that written policies reflect what is actually configured.
Keep the controls working afterwards
Certification does not replace ongoing security management, incident planning or backup testing. New starters, software changes and replacement devices can all affect the controls you have put in place.
Build these checks into ordinary IT work so preparation is supported by current records.
How CIS helps
CIS helps identify technical gaps, plan fixes and prepare evidence. Our Cyber Essentials support page explains the service and links to an engineering project. Certification remains dependent on a successful assessment.
