How to get Cyber Essentials certified: video walkthrough

Both certify the same five controls. Cyber Essentials is a verified self-assessment, signed as true by a board member and marked by a qualified assessor from a licensed certification body. Plus adds a hands-on technical audit: a remote vulnerability assessment, an authenticated scan of sampled devices, and checks of malware protection, multi-factor authentication and account separation, within three months of the Cyber Essentials certificate and on the same scope.

For many of them. PPN 014, for procurements started from 24 February 2025, requires central government departments, their agencies and non-departmental public bodies and NHS bodies to apply it to contracts involving citizens' or government employees' personal data, or ICT systems and services handling OFFICIAL data. A supplier without the certificate must show equivalent controls by other means, and certification is renewed every year of the contract. Defence suppliers follow Def Stan 05-138: Cyber Essentials at every risk level, Plus from Level 1.

Twelve months, at either level. The certificate describes your controls at a point in time, defined by the scheme as the date of issue, so renewal is a fresh assessment each year. Buyers can check that a certificate is current on the NCSC certificate search, which lists those issued in the last 12 months.

Yes, if that part is a well-defined, separately managed sub-set whose network is segregated from the rest by a firewall or VLAN, and the scope is agreed with the certification body beforehand. End-user devices must be included and cloud services cannot be excluded. Under Danzell you name every legal entity in scope and describe what is left out; the exclusions are not published. The included cyber liability insurance applies only when the whole organisation is certified.

Unsupported software anywhere in scope fails the assessment. Under Danzell, so does a cloud service without multi-factor authentication where it is available, and a critical or high-risk update not applied within 14 days to operating systems and router or firewall firmware (question A6.4) or to applications (A6.5). The assessor's report explains every non-compliant answer, and IASME allows two working days to fix simple issues and update the answers without a further fee.