Cyber Essentials and Cyber Essentials Plus: requirements and how to prepare

Cyber Essentials is the UK government-backed scheme that sets a baseline of five technical controls that protect against the most common internet attacks. Many public sector contracts, and a growing number of private ones, ask for it. Cyber Essentials Plus has the same requirements, plus hands-on technical verification of your systems.

Both certificates come from a Cyber Essentials certification body. ClearIMS helps you get organised and ready; it doesn't issue the certificate or send in your assessment.

The five controls

1. Firewalls. Every device connected to the internet is protected by a correctly configured firewall, and default passwords on routers and firewalls are changed.
2. Secure configuration. Remove unused software and accounts, change default passwords, and turn off features you don't need, such as auto-run.
3. User access control. People only have the access they need; admin accounts are used only for admin tasks; and multi-factor authentication is on for cloud services.
4. Malware protection. Anti-malware or application allow-listing is in place on the devices in scope.
5. Security update management. Software is supported and licensed, and high-risk and critical updates are applied within 14 days of release.

Why it matters

• Contracts and tenders. UK government contracts that involve handling personal or sensitive information often require it, and many buyers use it as a minimum.
• ISO 27001 overlap. The five controls map onto ISO 27001 Annex A controls such as 8.1 (user endpoint devices), 8.5 (secure authentication), 8.7 (protection against malware), 8.8 (technical vulnerabilities), 8.9 (configuration management) and 8.20 (network security). Work done for one counts towards the other.

What the certification body looks for

For Cyber Essentials, you answer a self-assessment questionnaire about your scope and how each control is met, and a director signs off that the answers are true. For CE Plus, an assessor then tests a sample of your devices and accounts.

Common reasons organisations fall short:

• Unsupported software still running, such as an old operating system on one laptop.
• Updates later than 14 days on some devices.
• No MFA on one cloud service.
• Scope gaps: home-working devices or a forgotten cloud service left out.
• Admin rights on everyday user accounts.

Common mistakes, and how to keep it manageable

• Answering from memory. Check each answer against your actual devices and services first, especially for Plus.
• One person holding all the answers. Give each answer an owner who knows that area.
• Treating it as once a year. Certificates last 12 months. Keep patching and access records up to date all year, so renewal is quick.
• Re-doing the work for ISO 27001 later. Set it up so the same evidence serves both.

How to do it in ClearIMS

1. Open Cyber Essentials. It holds the Cyber Essentials and CE Plus question bank in one workspace, instead of a spreadsheet emailed around.
2. Give each answer an owner and a due date, so less rides on one person and everyone can see what's outstanding.
3. Link the evidence behind each answer, and use the gap view to see what's missing or out of date, including any Plus remediation.
4. Take it to your certification body. When your answers are ready, submit your assessment through your chosen Cyber Essentials certification body.
5. Step up to ISO 27001 later. If you move to the full ISO 27001 plan, the evidence and owners you set up carry across to the matching ISO 27001 controls.

The Cyber Essentials plan is £39 a month, no VAT charged. See Cyber Essentials preparation for details.

Related pages

• Statement of Applicability: where Cyber Essentials work lands in ISO 27001.
• Assets: the devices and services in your Cyber Essentials scope.
• Vulnerabilities: tracking patching and fixes.
• Users and groups: who has access, and who has admin rights.