UK Cyber Essentials Certification: Complete Guide for Small Business (2026)

What Cyber Essentials Is and Why It Matters More in 2026

Cyber Essentials is a UK government-backed certification scheme managed by the National Cyber Security Centre (NCSC) and delivered through IASME, a government-appointed delivery partner. It tests whether a business has implemented five core technical security controls — the baseline defences that protect against the most common internet-based cyberattacks.

It matters for three reasons that have become increasingly pressing in 2026.

First, it is mandatory for any business bidding for UK central government contracts that involve handling sensitive information or personal data. If government work is part of your commercial pipeline, Cyber Essentials is not optional.

Second, it is increasingly required by larger private-sector buyers, insurers, and supply chain partners as a condition of doing business. Procurement questionnaires that previously asked about security policies now frequently ask for a Cyber Essentials certificate number.

Third, a new version of the scheme — Cyber Essentials v3.3, known as the Danzell question set — took effect on 27 April 2026, with meaningfully stricter requirements around multi-factor authentication and patch management. Businesses renewing certification or applying for the first time after that date are assessed against these updated standards. Understanding what changed is essential to passing first time.

And there is a fourth reason worth mentioning for smaller businesses specifically: UK businesses with under £20 million in annual turnover that achieve Cyber Essentials certification receive free cyber liability insurance covering up to £25,000 at no additional cost. For a small business that doesn’t currently carry cyber insurance, this alone often exceeds the cost of certification.

Cyber Essentials vs Cyber Essentials Plus

There are two levels of certification. Understanding the difference determines which is right for your business.

Cyber Essentials is a self-assessment. Your business answers a structured questionnaire about its IT environment, security configurations, and controls. A certification body assessor reviews your answers and verifies they are consistent and plausible. If they are satisfied, a certificate is issued. You are attesting to your own compliance — no external technical testing of your systems.

Cyber Essentials Plus builds on Cyber Essentials. You must hold a valid basic Cyber Essentials certificate before applying for Plus, and you have three months after receiving it to complete the Plus assessment. Plus involves a hands-on technical audit by an external assessor, who remotely tests your actual systems: authenticated vulnerability scans of devices, testing of browser and email security configurations, and verification that the controls you self-attested are genuinely in place.

For most small businesses: basic Cyber Essentials is sufficient. It satisfies the government contract requirement, includes the insurance benefit, and demonstrates a credible security baseline to buyers and clients.

Cyber Essentials Plus is worth pursuing if: a specific contract or client relationship explicitly requires it; you want independent verification of your security rather than self-attestation; or you operate in a sector (defence, healthcare, financial services) where higher assurance is expected.

The Five Controls: What You’re Actually Assessed On

Cyber Essentials tests five technical control areas. The controls themselves have not changed under Danzell — only how rigorously certain elements are assessed.

Control 1: Firewalls

Every device connected to the internet must be protected by a firewall. For most small businesses, this means a broadband router with an active firewall, properly configured to block inbound connections that haven’t been specifically authorised.

What assessors look at: Is a firewall in place at the network boundary? Are default administrative passwords changed? Are only necessary network ports open? Is unauthenticated access to administrative interfaces blocked from the internet? Are rules documented and reviewed?

Common failure points: Routers left on factory-default settings with default admin passwords unchanged. Remote management interfaces accessible from the internet. Rules opened for legacy services that are no longer in use.

For businesses with multiple offices, remote workers, or cloud-based systems, the firewall requirement extends to each network location and each device connecting directly to the internet. A laptop connecting from a hotel over public Wi-Fi is directly internet-connected and must have its own software firewall enabled.

Control 2: Secure Configuration

Devices and software must be configured securely — default settings changed, unnecessary software removed, and unnecessary features disabled. The principle is that every system should be set up with the minimum functionality required to do its job.

What assessors look at: Are default passwords changed on all accounts? Is unnecessary software removed or disabled? Is auto-run disabled for removable media? Are operating systems and applications running on supported versions (end-of-life software that no longer receives security updates is a specific failure point)?

Common failure points: Devices shipped with factory-default administrator passwords never changed. Outdated operating systems running past their vendor support end date — Windows 10 reaching end of life in October 2025 is the most common current gap for UK small businesses. Applications with default administrative credentials.

End-of-life software is specifically assessed and will cause a failure. Any device in scope running an operating system or application that no longer receives security updates must either be updated or excluded from the certification scope.

Control 3: User Access Control

User accounts must only have access to what they need, and accounts with administrative privileges must be used only for administrative tasks — not for general browsing or email. This is the principle of least privilege.

What assessors look at: Are user accounts given only the access they need for their role? Are administrative accounts separate from standard user accounts? Are administrative accounts used only for administrative tasks, not general internet access? Are accounts for users who have left the organisation removed promptly? Is there a process for reviewing who has access to what?

Common failure points: All users configured with local administrator rights on their own machines. A single administrator account used for both administrative tasks and daily work. Former employees’ accounts remaining active weeks or months after departure. Shared accounts where no individual is accountable.

Under Danzell, the requirements around MFA have been significantly strengthened and directly affect user access control for cloud services. This is covered separately below.

Control 4: Malware Protection

Devices must have active protection against malware (malicious software) in place. This can be met through anti-malware software or, for managed operating systems on supported versions, through application allow-listing that prevents unapproved software from executing.

What assessors look at: Is anti-malware software installed and active on all in-scope devices? Is it configured to scan files automatically and update definitions regularly? Is malware protection enabled on mobile devices accessing business data? Is it centrally managed where possible?

Common failure points: Anti-malware with expired licence or outdated definitions. No malware protection on employee mobile phones accessing business email. Consumer free-tier antivirus on business devices (check EULA — many prohibit commercial use). Anti-malware disabled by users or IT staff for convenience.

Microsoft Defender, configured correctly and actively updated, is an acceptable control for Windows devices. It must be centrally managed and actively monitored — not simply installed and left to its defaults.

Control 5: Security Update Management (Patch Management)

All software — operating systems, applications, firmware on routers and firewalls — must be kept up to date with security patches. This is the control area with the most significant change under Danzell v3.3.

What assessors look at (under Danzell v3.3): Are security updates applied within 14 days of release for operating systems, router and firewall firmware, and applications? Is software that has reached end-of-life and no longer receives security updates either replaced or excluded from scope?

Critical change from April 2026: Under the previous question set, patch management was assessed but a grace period was implicit. Under Danzell (v3.3), failure to apply high and critical patches within 14 days is an automatic failure — there is no opportunity to remediate within the current assessment cycle. A single critical patch deployed 15 days after release will fail the entire assessment.

The 14-day window applies to: operating systems on all in-scope devices, router and firewall firmware, and all in-scope applications. It does not require patching every minor update within 14 days — it applies specifically to patches rated high or critical severity by the vendor.

The Danzell v3.3 Changes: What’s Different Since April 2026

The Cyber Essentials v3.3 update (the Danzell question set) took effect on 27 April 2026 for new assessment accounts. If you created your assessment account before that date, you complete under the previous Willow version within the six-month completion window. All new accounts from 27 April 2026 onward use Danzell.

The five controls remain the same. The significant changes are in how they are assessed.

MFA on Cloud Services Is Now an Automatic Failure

Under previous versions, MFA on cloud services was expected but not an absolute requirement. Under Danzell, if a cloud service that is in scope for the assessment has MFA available and it is not enabled, the assessment automatically fails.

This applies regardless of:

• Whether MFA is a free or paid feature of the service
• Whether users find it inconvenient
• Whether MFA is the default setting for the service or requires activation

In 2026, virtually every mainstream SaaS product offers MFA: Microsoft 365, Google Workspace, Xero, QuickBooks, Salesforce, HubSpot, Slack, Dropbox, GitHub, Zoom, DocuSign. If your business uses any of these and has not enabled MFA on every user account, you will automatically fail a Danzell assessment.

The most common gaps for small businesses:

• Shared mailboxes (info@, accounts@, support@) accessed by multiple staff — Microsoft 365 supports MFA on shared mailboxes; it must be configured
• Social media accounts with shared logins — Danzell requires individual accounts with MFA; shared social media logins must migrate to managed business accounts
• Older cloud applications that don’t support MFA — if MFA-capable alternatives exist, assessors may question why migration hasn’t occurred; these may require replacement

SMS codes remain an acceptable MFA method under Danzell, though authenticator apps and FIDO2 hardware keys are preferred. The test is not which MFA method is used, but that MFA is enforced on every account.

Critical Patching Within 14 Days Is Now an Automatic Failure

Under Danzell, questions A6.4 and A6.5 about security update management became automatic failures. High and critical patches for operating systems, router/firewall firmware, and applications must be applied within 14 days of release. A missed patch — even one device, one application, documented in the assessment — causes the entire assessment to fail.

For small businesses without formal patch management: this makes automated or at minimum closely managed patching essential before assessment. Manually checking every device for updates and applying them within 14 days is achievable for a very small fleet (under 10 devices) but unsustainable for larger environments without tooling.

Cloud Services Are Explicitly In Scope

Previous versions left some ambiguity about whether cloud services were in scope. Danzell removes that ambiguity: cloud services are now explicitly defined and must be included in scope if they store or process your organisation’s data.

If your data is in Microsoft 365, Google Workspace, your accounting platform, your CRM, your HR system, or any other SaaS application, those services are in scope. You cannot exclude them from the assessment to avoid addressing their security configuration.

The cloud shared responsibility model applies: the cloud provider is responsible for the security of the platform infrastructure; you are responsible for how you configure and use the service — specifically, who has access, whether MFA is enabled, and whether administrative privileges are appropriately restricted.

Cyber Essentials Plus Now Includes Double Sampling

For businesses pursuing Plus: the technical audit now includes double sampling. A second independent sample verifies that remediation was applied estate-wide rather than just on the initially tested devices. You cannot fix one laptop and present it as representative of your fleet.

Pricing: What Cyber Essentials Costs in 2026

Basic Cyber Essentials (Self-Assessment)

The certification fee is set by IASME and tiered by organisation size. For 2026:

Some certification bodies add a small administration premium or bundle preparation support into the price. Compare two or three quotes from IASME-licensed certification bodies before booking. The fee is paid directly to the certification body when you submit the self-assessment.

If you work with an IT support provider or an NCSC-assured Cyber Advisor who assists with preparation, budget an additional £150–£400 for guided support, depending on your IT complexity and how much remediation is required.

Cyber Essentials Plus (Technical Audit)

Cyber Essentials Plus pricing varies by certification body and is not fixed by IASME. Indicative 2026 pricing for small businesses:

• Small businesses (10–49 staff, straightforward environment): approximately £1,400–£2,250 + VAT
• Larger or more complex environments: £2,500–£4,000+ + VAT

You must hold a valid basic Cyber Essentials certificate before applying for Plus, and you have three months after receiving it to complete the Plus assessment. Timing matters — don’t apply for Plus certification if your three-month window is at risk.

The Free Cyber Insurance Benefit

UK businesses with annual turnover under £20 million that certify Cyber Essentials for their whole organisation receive free cyber liability insurance coverage of up to £25,000 at no additional cost. This insurance covers cyber incident response costs, business interruption, and data recovery.

For a small business that does not currently carry cyber insurance, this benefit alone often exceeds the cost of the certification fee. Factor it into the value calculation when assessing whether to certify.

Year-One vs Renewal Cost

Year one is almost always more expensive than renewal, because it carries the remediation and preparation costs. If your organisation has significant gaps to address — end-of-life software to replace, MFA to implement across all cloud services, patch management to formalise — the cost of fixing those gaps before the assessment can exceed the certification fee itself.

Renewal is faster and cheaper. Controls are already in place; the annual process is verifying they remain in place and that any new systems or cloud services are included in scope.

The Certification Process: Step by Step

Step 1: Determine Your Scope

Your scope defines which devices, networks, and services are included in the assessment. Defining scope sensibly is important — too broad and you multiply complexity; too narrow and the certificate may not satisfy the buyer or government requirement that prompted you to seek it.

Scope typically includes:

• All devices used to access business data (laptops, desktops, company mobile phones)
• Your office network and any other networks your devices connect to
• All cloud services used to store or process business data
• Your internet-facing services (website, remote access systems, externally accessible applications)

Devices used exclusively offline, or specific devices used only for non-networked tasks, may be eligible for exclusion. Personal devices (BYOD) are a common complication: if a personal device accesses business cloud services such as email, it must meet the same technical requirements as corporate devices or be restricted to a secure container (corporate app with enforced security policy). A written BYOD policy without enforced technical controls will not satisfy the assessment.

If your business is part of a group or franchise, each legal entity typically requires its own certificate.

Step 2: Choose a Certification Body

Certification bodies are accredited by IASME. A full list of IASME-licensed certification bodies is available on the IASME website. You can apply directly through any licensed body.

For basic Cyber Essentials, most certification bodies offer a similar process. Compare:

• Whether preparation support is included or separately charged
• Their familiarity with your sector or technology stack
• Whether they offer Cyber Essentials Plus assessment if you intend to pursue it
• Pricing against the IASME fee band for your organisation size

Many IT support providers and MSPs are either licensed certification bodies or work with a preferred partner. If your IT is managed, check whether your provider offers Cyber Essentials assessment as part of their services — this often simplifies preparation because they already know your environment.

Step 3: Conduct a Pre-Assessment Gap Review

Before creating your assessment account and starting the formal process, review the five controls against your current environment. Identify where you have gaps and address them before submission.

The most common failures on first submission are:

• MFA not enabled on one or more cloud services (automatic failure under Danzell)
• End-of-life software present on devices in scope — Windows 10 past its October 2025 end of life is the most common current gap
• Default administrative passwords not changed on routers or other network devices
• Users with unnecessary administrative privileges
• Patches not applied within 14 days (automatic failure under Danzell)

The NCSC publishes free pre-assessment resources. The CyberEssentials.ncsc.gov.uk website includes the official requirements document and a readiness tool. Working through these before creating your assessment account prevents avoidable failures.

Step 4: Create Your Assessment Account and Complete the Questionnaire

Register with your chosen certification body and create your assessment account. New accounts created from 27 April 2026 use the Danzell question set.

The self-assessment questionnaire asks about your IT environment and how the five controls are implemented. You will need to know:

• What devices are in scope and what operating systems they run
• Which cloud services you use and whether MFA is enabled on all accounts
• How patches are managed and what your current patch status is
• How user accounts are managed and what access controls are in place
• What anti-malware or malware protection is deployed
• How your network boundary is protected

The questionnaire is designed to be answerable by an IT-aware business owner or administrator — not exclusively by security specialists. However, you do need accurate knowledge of your IT setup. If you are not confident about specific configurations, verify them before answering.

Step 5: Submit and Receive Your Certificate

The certification body reviews your completed questionnaire. If your answers are consistent, credible, and indicate that the five controls are in place, your certificate is issued — typically within a few working days of submission.

If the assessor identifies inconsistencies or areas requiring clarification, they will contact you before issuing a decision.

Your certificate is valid for 12 months. Annual renewal is required to maintain it.

Step 6 (Optional): Cyber Essentials Plus Assessment

If you need or want Plus, engage a certification body for the technical audit within three months of receiving your basic certificate. The assessor will remotely test your systems: vulnerability scans, browser configuration testing, email client testing, and verification of malware protection and update status.

Under the Danzell update, Plus now includes double sampling — a second independent sample of devices verifies that controls are genuinely applied estate-wide, not just on the specific devices presented for testing. Ensure all in-scope devices are consistently configured, not just those you expect to be tested.

The Danzell Checklist: What to Fix Before You Apply

Use this to prepare before creating your assessment account.

MFA — check every cloud service:

• ☐ Microsoft 365 — MFA enabled on every user account including shared mailboxes
• ☐ Google Workspace — MFA enforced at the domain level
• ☐ Accounting software (Xero, QuickBooks, Sage) — MFA enabled on every account
• ☐ CRM (Salesforce, HubSpot, Pipedrive) — MFA enabled
• ☐ Cloud storage (Dropbox, OneDrive, Google Drive) — MFA enforced
• ☐ Code repositories (GitHub, GitLab) — MFA required for all contributors
• ☐ Communication tools (Slack, Teams, Zoom) — MFA enabled
• ☐ HR and payroll systems — MFA enabled
• ☐ Any other SaaS storing or processing business data — MFA enabled
• ☐ Social media business accounts — individual accounts with MFA (not shared logins)

Patching — verify 14-day compliance:

• ☐ All devices running supported operating systems (Windows 10 reached end-of-life October 2025 — upgrade to Windows 11 or exclude from scope)
• ☐ All high and critical patches applied within 14 days on all in-scope devices
• ☐ Router and firewall firmware on current supported version
• ☐ No software running past vendor end-of-support date

Firewalls:

• ☐ Default admin passwords changed on router/firewall
• ☐ Remote management interfaces not accessible from the internet
• ☐ Software firewall enabled on all devices connecting to untrusted networks (home Wi-Fi, public Wi-Fi)

Secure configuration:

• ☐ Default passwords changed on all accounts and devices
• ☐ No unnecessary user accounts present
• ☐ Auto-run disabled for removable media

User access control:

• ☐ Users have only the access they need for their role
• ☐ Separate administrator accounts not used for general browsing or email
• ☐ Accounts for departed employees removed
• ☐ MFA on all accounts with administrative access

Malware protection:

• ☐ Anti-malware installed and active on all in-scope devices
• ☐ Real-time scanning enabled
• ☐ Definitions updated automatically

Who Needs Cyber Essentials?

Mandatory situations:

Any business bidding for UK central government contracts that involve handling sensitive information — including many MOD, NHS, and other public sector contracts — must hold a valid Cyber Essentials certificate. This is a hard requirement: no certificate, no contract. Verify the specific requirements with the contracting body, as some contracts specifically require Cyber Essentials Plus rather than basic.

Strongly advisable situations:

Any business supplying into the government supply chain, even indirectly. Supply chain requirements from prime contractors increasingly flow down to smaller suppliers.

Any business seeking cyber insurance in the UK. Insurers are increasingly using Cyber Essentials as a baseline indicator of security maturity. Some insurers offer discounted premiums for certified businesses; some use absence of certification as a factor in assessing risk.

Any business where clients ask about your security posture during procurement or onboarding. A certificate number is a faster, more credible answer to security questionnaires than a self-written policy document.

Not necessarily required for:

Businesses with no government contracts, no supply chain relationships that require it, and clients who don’t ask about security certifications. Cyber Essentials is valuable for any business as a baseline security framework — but the financial case is strongest when an external requirement is driving it.

Common Reasons for Failing First Time

Understanding the most common failure points prevents avoidable re-assessments.

MFA missing on any in-scope cloud service. Under Danzell, this is an automatic failure. There is no opportunity to fix it within the current assessment cycle. Review every cloud service you use before submitting.

End-of-life software in scope. Operating systems or applications past their vendor support date generate an automatic failure on the secure configuration control. The most common current issue is Windows 10 (end-of-life October 2025). Audit every device before submitting.

Patches more than 14 days old. Under Danzell, this is automatic failure. Run a patch status check across all in-scope devices in the week before submission.

Default credentials unchanged. Routers and firewalls on default passwords are a consistent failure point. Check every network device.

BYOD (bring your own device) not addressed. Personal devices accessing business cloud services are in scope. Either enforce technical controls through MDM and conditional access, or document a policy that prevents personal devices from accessing business data entirely. A written BYOD policy without enforcement will not satisfy the assessment.

Scope too broadly defined. Including legacy systems, printers, or specialist equipment that would fail the assessment — when those devices don’t actually need to be in scope — is a self-inflicted failure. Define scope carefully before submitting.

Comparison: Cyber Essentials vs ISO 27001

Small businesses sometimes ask whether Cyber Essentials or ISO 27001 is more appropriate for them.

For most UK small businesses: Cyber Essentials is the right starting point. ISO 27001 makes sense when your buyers are large enterprises with global procurement processes, or when you operate in a regulated sector where ISO 27001 is specifically required.

What to Avoid

Don’t create your assessment account before you’re ready. Under Danzell, certain failures — missing MFA on a cloud service, a critical patch over 14 days old — are automatic and cannot be remediated within the current assessment cycle. You must start again with a new account (and pay again). Fix the gaps before you begin.

Don’t exclude cloud services from scope to avoid addressing MFA. Under Danzell, cloud services that store or process your business data cannot be excluded from scope. An exclusion of Microsoft 365 or Google Workspace on the grounds that you haven’t enabled MFA is not permissible. The exclusion must be legitimate (a device not used for business purposes), not a workaround for a control you haven’t implemented.

Don’t confuse the certificate fee with the total cost. The certification fee is typically £320–£440 for a small business. The total cost includes any IT work needed to meet the five controls — enabling MFA across all services, updating or replacing end-of-life software, implementing patch management, changing default credentials. For businesses with significant gaps, remediation costs can substantially exceed the fee.

Don’t certify and then let controls slip. Cyber Essentials is an annual commitment, not a one-time exercise. If you implement MFA to pass the assessment but don’t maintain it throughout the year, your renewal will expose gaps — and more importantly, you’ll be vulnerable for the months between.

Final Verdict

Cyber Essentials is the most accessible, most cost-effective security baseline available to UK small businesses. The certification fee for a small business is £440 + VAT. It comes with free cyber liability insurance worth up to £25,000 for businesses under £20 million turnover. It is required for government contracts. It is increasingly expected by private sector buyers and insurers.

The five controls it tests — firewalls, secure configuration, user access control, malware protection, and patching — are not bureaucratic checkbox exercises. They are the foundational security measures that stop the most common attacks that hit small businesses every day. Implementing them properly reduces your breach risk in ways that are measurable and documented.

The April 2026 Danzell update made two things automatic failures that weren’t before: missing MFA on any cloud service, and critical patches older than 14 days. Both of these were good practice before Danzell. The update simply made them mandatory. For a business that has already implemented MFA everywhere and keeps software updated, the changes are minor. For a business that hasn’t, they define the remediation work needed before certification.

Enable MFA on every cloud service. Keep software patched. Change default credentials. The certificate follows.

Frequently Asked Questions

Is Cyber Essentials a legal requirement for UK businesses?

Not universally. Cyber Essentials is mandatory for UK central government contracts that involve handling sensitive information or personal data. Outside of government contracting, it is not a legal requirement — but it is increasingly required as a condition of doing business by larger private-sector organisations, insurers, and supply chain partners. The government’s position is that Cyber Essentials should be the minimum security baseline for all organisations, but it has not legislated this requirement for the private sector outside of government procurement.

How long does Cyber Essentials certification take?

For a business that already meets the five controls, the process typically takes one to four weeks from starting the self-assessment to receiving the certificate. The questionnaire itself can be completed in a few hours by an IT-aware administrator. Review and issuance by the certification body typically takes a few working days. The timeline extends significantly if remediation is needed — particularly if end-of-life software must be replaced, or if MFA needs to be implemented across multiple cloud services, both of which take time to plan and deploy correctly.

What happens if I fail the Cyber Essentials assessment?

You receive feedback identifying which control areas did not meet the requirements. Under Danzell, automatic failures (missing MFA on a cloud service, patches over 14 days old) cannot be remediated within the current assessment — you must address the issue and create a new assessment account. Other failures can often be remediated and resubmitted within a defined window depending on your certification body’s process. The fee is typically not refundable on failure. Address the most common failure points — MFA on all cloud services, current patching, no end-of-life software — before creating your assessment account.

Does Cyber Essentials certification expire?

Yes. Certification is valid for 12 months. You must renew annually to maintain it. Any contract, insurance policy, or supply chain requirement that depends on Cyber Essentials will check the currency of the certificate. Renewal is typically faster than the initial certification because controls are already in place — the process is verifying they remain in place and that any new cloud services or devices added during the year are included in scope and meet requirements.

What’s the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five technical controls and are valid certificates for contract and insurance purposes. The difference is the assurance level: Cyber Essentials is a self-assessment, meaning you attest to your own compliance; Cyber Essentials Plus is an independently tested assessment, where a certified assessor technically verifies that the controls are genuinely in place on your actual systems. Plus provides higher assurance and is required by some contracts that specifically mandate it. For most small businesses, basic Cyber Essentials is sufficient unless a specific contractual requirement states otherwise.

Information accurate as of July 2026, reflecting Cyber Essentials v3.3 (Danzell question set, effective 27 April 2026). Certification fees and requirements are set by IASME and the NCSC and are subject to change. Always verify current pricing and requirements directly with an IASME-licensed certification body before beginning the assessment process. For the official requirements and the current question set, see NCSC Cyber Essentials and IASME.

Related reading on SmallBiz Defense:

• Best Multi-Factor Authentication (MFA) Apps for Business in 2026 (Reviewed)
• Patch Management Software for Small Business: Top 6 Options in 2026 (Reviewed)
• Best Antivirus Software for Small Business in 2026 (Tested)