What are the Cyber Essentials Requirements?

Cyber Essentials is a UK government-backed certification scheme designed to help organisations protect themselves against the most common cyber threats. It sets out a baseline level of cyber security that all organisations regardless of size or sector should have in place.

If you’re wondering “What exactly do we need to do to become Cyber Essentials certified?” we’ll break it down for you…

What is Cyber Essentials?

Cyber Essentials focuses on five core technical controls that protect against the majority of basic cyber attacks, including phishing, malware, and unauthorised access.
Certification is awarded following an assessment that confirms these controls are correctly implemented and managed.

There are two levels; Cyber Essentials (self-assessment, externally verified) and Cyber Essentials Plus (includes hands-on technical testing). This article focuses on the core requirements, which apply to both levels.

Five Cyber Essentials Requirements

To achieve Cyber Essentials, your organisation must meet requirements across the following areas;

1. Firewalls and Internet Gateways. Requirement – you must have a firewall in place to protect your network from unauthorised access.

What this means in practice;

• A firewall is installed on all internet-connected devices and networks
• Only necessary ports and services are allowed
• Default passwords are changed
• Administrative access is restricted and secured

This ensures attackers cannot freely access your systems from the internet.

2. Secure Configuration. Requirement – systems must be configured securely to reduce vulnerabilities.

What this means in practice;

• Unnecessary software, services, and user accounts are removed or disabled
• Default settings and credentials are changed
• Devices are set up following recognised security best practices
• Users do not have admin rights unless genuinely required

Secure configuration limits the attack surface available to cyber criminals.

3. User Access Control. Requirement – only the authorised people should have access to the required systems.

What this means in practice;

• User accounts are unique to each individual
• Access is based on job role and business need
• Administrator privileges are tightly controlled
• Accounts are removed or disabled promptly when staff leave

This prevents both accidental misuse and malicious insider threats.

4. Malware Protection. Requirement – your organisation must protect devices against malware.

What this means in practice;

• Anti-malware software is installed and active on all relevant devices
• Malware protection is kept up to date
• Users are prevented from running unauthorised software
• Email attachments and downloads are controlled

This reduces the risk of ransomware, spyware, and other malicious software.

5. Patch Management (Updating Software). Requirement – all software and devices must be kept up to date with security patches.

What this means in practice;

• Operating systems and applications receive updates within defined timescales
• Critical security updates are applied promptly
• Unsupported or end-of-life software is removed or replaced

Regular patching closes known vulnerabilities that attackers actively exploit.

What Does the Assessment Involve?

For Cyber Essentials, you’ll complete a structured questionnaire, technical declarations about your systems and external verification of your answers by a certification body. For Cyber Essentials Plus, this is followed by independent vulnerability scans, configuration checks and real-world testing of your systems.

Who Needs Cyber Essentials?

• SMEs and large organisations
• Public and private sector businesses
• Organisations handling personal data
• Suppliers bidding for UK government contracts (often mandatory)

It’s especially valuable if you want to demonstrate baseline cyber security maturity to clients, partners, and regulators.

Why does Cyber Essentials Matter?

CE is important for two main reasons, the impact it has on your security awareness within your organisation, and the perception of your security from an external viewpoint. Cyber Essentials reduces your risk of common cyber attacks because you are required to implement and maintain basic security practices, this in turn builds trust with customers and suppliers. In certain industries or with certain contractors, CE is a requirement, therefore having the certification helps meet contractual and regulatory requirements. Fundamentally, CE shows commitment to cyber security best practice. For many organisations, it’s the first step in a wider – and increasingly necessary – cyber security journey.

Our Final Thoughts

The Cyber Essentials requirements are intentionally practical and achievable. They don’t demand complex or expensive security solutions, just good cyber hygiene, consistently applied.

If your organisation can confidently meet the five core controls, you’re well on your way to certification and in a world which is increasingly technical and automated, implementing and maintaining basic (or advanced) cyber security hygiene can only be a good thing.