Cyber Essentials · Cyber Essentials Plus · UK NCSC scheme
Cyber Essentials certification consulting for a baseline your UK customers can verify.
Get Cyber Essentials certified by an IASME-licensed certification body, first time, and Cyber Essentials Plus where your customer or contract requires the audited level. Sterling's expert and experienced consultants put the five technical controls in place across your devices, cloud services and networks with your IT team, prepare truthful answers and the evidence behind them, and stay with you through certification and every annual renewal, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cybersecurity consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an IASME-licensed certification body assesses and certifies
8,100+ client engagements in 60+ countries.
Cyber Essentials client experience
What it is
What is Cyber Essentials and what is it used for?
Cyber Essentials is the UK government-backed certification scheme that shows an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. It is the scheme of the National Cyber Security Centre (NCSC), the UK's technical authority for cyber security, which calls it the minimum standard of cyber security the Government recommends for organisations of all sizes. It went live in June 2014; since 1 April 2020 IASME, the NCSC's official Cyber Essentials delivery partner, has run it through certification bodies that IASME licenses.
There are two levels. Cyber Essentials is a verified self-assessment: you answer the question set online, a board member signs a declaration that every answer is true, and a qualified assessor from the certification body marks it. Cyber Essentials Plus rests on the same requirements and adds an independent technical audit, on site or remote, of a representative set of user devices, every internet gateway and every server offering services to unauthenticated internet users. Neither level is a management system: the controls simply have to be working on every device, account and service in scope on the day the certificate is issued.
For a buyer the value is a certificate that can be looked up. For you the harder question is whether the controls hold between renewals, on the laptop at home and the cloud account nobody remembered opening.
Current requirements. Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026 and assessed through the Danzell question set, applies to every assessment account created from 27 April 2026. It replaced v3.2 and the Willow question set, in force since 28 April 2025; an account opened under Willow keeps six months from creation to certify. The scheme is reviewed every year, so each renewal is marked against the set current when its account opens. Plus audits follow the NCSC's Plus test specification, v3.2 of April 2025 at the time of writing. What changes in Danzell and v3.3, and how to prepare
Who it is for
Who needs Cyber Essentials certification?
Cyber Essentials fits a five-person firm as well as a group of companies, and the request usually comes from a buyer: UK public procurement writes it into policy, and a growing number of other organisations require it before suppliers can bid. Organisations come to Sterling for Cyber Essentials from four starting points:
- A UK government or NHS contract requires it. Procurement Policy Note 014 applies it across central government departments, their agencies and public bodies, and NHS bodies, including contracts involving citizens' or government employees' personal data, or ICT systems and services handling OFFICIAL data. The certificate, or proof of equivalent controls, is expected before data reaches you.
- A defence prime, a bank or a large UK customer has asked. Def Stan 05-138, the Ministry of Defence's cyber standard for suppliers, requires Cyber Essentials at every cyber risk level and Plus from Level 1 upwards; in October 2024 six major UK financial institutions committed to widen its use in their supply chains.
- You want the most common attacks shut out. Nobody has asked, but an exposed service, an unpatched laptop or a reused password is the gap you want closed. Eligible UK organisations certifying their whole organisation can also opt in to the included cyber liability insurance.
- You hold ISO/IEC 27001 or a SOC 2 report and a UK buyer still wants the certificate. Your ISMS helps, but Cyber Essentials is pass or fail on specific settings across every in-scope device. The gaps are concrete: an unsupported operating system, a cloud service without multi-factor authentication, updates slower than 14 days.
The intended benefit is a smaller attack surface and a certificate your customers can check. Both depend on the controls staying in place.
Business benefits
How Cyber Essentials supports security and UK contract eligibility
A Cyber Essentials programme pays back twice: when a bid asks the question, and on every ordinary day an automated scan of your network finds nothing to exploit. We start from the services you expose to the internet, the devices your people use and the cloud accounts that hold your data.
- Eligible for UK public contractsThe certificate PPN 014 and Def Stan 05-138 ask suppliers to hold, in place before the contract starts.
- Fewer successful common attacksThe five controls close the routes the most common attacks use. Insurance data cited by the UK government in October 2024 puts certified organisations 92% less likely to make a claim on their cyber insurance.
- A certificate buyers can checkListed on the NCSC certificate search by name or number, with level and expiry, so a buyer can confirm it without asking you.
- Cloud accounts that resist stolen passwordsMulti-factor authentication on every cloud service that offers it, and administrator accounts kept away from e-mail and browsing.
- Known weaknesses fixed against a clockCritical and high-risk updates applied within 14 days of release, and unsupported software removed or fenced off.
- A foundation for the next frameworkThe same controls and evidence carry into ISO/IEC 27001, IASME Cyber Assurance and a NIST CSF 2.0 profile.
Measure what the controls change: devices patched inside 14 days, cloud services with multi-factor authentication enforced, and how long any system runs past its end of support. A badge on the website is not the result; those numbers are.
Requirements
What are the main Cyber Essentials requirements?
The NCSC publishes the requirements as Cyber Essentials: Requirements for IT Infrastructure, now v3.3, and IASME's question set tests them. There are no clauses to interpret: each requirement is a technical setting or practice that must be true of every device, account and service in scope, and some questions are automatic fails. The table is a plain-language map; the certification body marks your answers against the full requirement text.
| Requirement | What it requires of you | What it looks like in practice |
|---|---|---|
| Scope Boundary of the assessment | Cover the whole IT infrastructure used for the business, or a well-defined, separately managed sub-set segregated by a firewall or VLAN, agreed with the certification body before assessment begins | A scope statement naming each legal entity, the network boundary and the locations, with end-user devices, servers, home and remote working, personal devices that reach organisational data, and every cloud service included |
| 1 Firewalls | Make sure only secure and necessary network services can be reached from the internet | A correctly configured firewall protecting every device, default administrator passwords changed, administrative interfaces kept off the internet unless protected by multi-factor authentication or an IP allow list, unauthenticated inbound connections blocked, inbound rules approved and documented, and a software firewall on devices used on untrusted networks |
| 2 Secure configuration | Configure computers and network devices to reduce vulnerabilities and run only the services their role needs | Unnecessary accounts and software removed or disabled, default or guessable passwords changed, auto-run disabled, users authenticated before they reach organisational data, and devices locked with a biometric, password or PIN that is protected against repeated guessing, at least six characters where it only unlocks the device |
| 3 Security update management | Keep devices and software free of known vulnerabilities for which fixes exist | Only licensed, supported software in scope; automatic updates switched on where possible; fixes the vendor rates critical or high risk, or with a CVSS v3 base score of 7 or above, applied within 14 days of release |
| 4 User access control | Give accounts only to authorised people, with only the access their role needs | Approved account creation, unique credentials, inactive accounts removed, separate administrator accounts used only for administration, multi-factor authentication always on cloud services, and password quality managed by multi-factor authentication, a 12-character minimum, or an 8-character minimum with common passwords blocked |
| 5 Malware protection | Stop known malware and untrusted software from running, causing damage or reaching data | Anti-malware software on Windows and macOS servers, desktops and laptops, set to stop malware running, block malicious code and prevent connections to malicious websites, or application allow-listing on any in-scope device so only approved, code-signed applications run |
| Plus Technical audit | Show that the controls described in the self-assessment work on real systems | A remote vulnerability assessment, an authenticated vulnerability scan of sampled devices, and checks of malware protection, multi-factor authentication and account separation, on the same scope as the self-assessment certificate |
What does useful Cyber Essentials evidence look like?
An inventory of every in-scope device with its operating system and support status, a register of cloud services showing where multi-factor authentication is enforced, approved firewall rules, update reports showing critical and high-risk fixes landing inside 14 days, the administrator account list and malware protection status by device. The basic level includes no test or scan, but your board signs that every answer is true and a Plus assessor tests the same claims. The evidence lives in Effivity, so next year's renewal starts from records, not memory.
Cyber Essentials requirements explained, control by controlCertification process
How do you get Cyber Essentials certified?
Put the controls in place first, then answer the questions accurately and have a licensed certification body mark them. Sterling prepares your organisation and supports it through the assessment. The certificate comes from the certification body, and the declaration is signed by your own board, which is why every answer has to be true.
- 01Define the scope, the legal entities and the level.Whole organisation or segregated sub-set, the legal entities, Cyber Essentials or Plus, and the scope agreed with the certification body before assessment.
- 02Gap analysis: review every device, account and cloud service against the five controls.The gap analysis inventories the scope, tests it against each requirement and automatic-fail question, keeps what complies and agrees fixes, owners and dates.
- 03Remediate and record.Replace or segregate unsupported systems, switch on multi-factor authentication, tighten firewall rules and administrator access, start the 14-day update routine and keep the evidence.
- 04Check the answers before anyone signs them.Sterling reviews every answer against its evidence and, for Plus, rehearses the audit tests, so failures surface while there is time to fix them.
- 05Complete the independent assessment.Open the assessment with a licensed certification body and submit within six months; a board member signs the declaration and a qualified assessor marks it. Any Plus audit follows within three months of the certificate, on site or remote.
- 06Renew every 12 months.Both certificates expire after 12 months: keep the controls operating, update the scope and reassess against the question set then in force.
Check who will certify, not just the quoted price. Confirm the certification body on IASME's published list, look up any certificate you are shown on the NCSC certificate search, and ask which level and scope a quotation covers. Be wary of offers to complete the questionnaire for you: the declaration your board signs says the answers are true, and a certificate resting on untrue answers will not survive a Plus audit, an insurer's questions or an incident. How to choose a credible Cyber Essentials provider · The certification buyer's checklist
Cost
How much does Cyber Essentials certification cost?
The certification fee is the small, predictable part, because IASME publishes it. The larger variable is the work to bring your estate into line, which depends on how many devices and cloud services are in scope and how much of it is out of date. What we can promise is a proposal with every component visible and our fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | The state of your devices, accounts and cloud services today, the number of sites and legal entities, and how much of the remediation your team takes on (Design™ or Drive™) |
| Cyber Essentials assessment | A fixed fee published by IASME by organisation size; in September 2026 it listed £320 for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, each plus VAT |
| Cyber Essentials Plus audit | Quoted individually by the certification body according to the size and complexity of your network |
| Remediation and internal resources | IT staff or provider time, replacement of unsupported hardware or software, and licences for multi-factor authentication or device management |
| Software and learning | Included in a Sterling engagement: Effivity for the registers and the evidence, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | The annual renewal, question-set changes, new devices and services, and the Plus re-audit each year under Sustain™ |
What moves the price
- The number and variety of devices, operating systems and cloud services in scope
- Unsupported software or hardware that has to be replaced or segregated
- Whole organisation or a sub-set, and the number of legal entities and sites
- Cyber Essentials alone, or Cyber Essentials Plus with its technical audit
- The contract deadline, and how much of the work your IT team or provider can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- IASME and certification-body fees shown separately, so the full cost of the programme is comparable
- Effivity, training and Academy access listed at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does Cyber Essentials certification take?
The assessment itself is quick: IASME says a prepared self-assessment can take about an hour, and a qualified assessor reviews the answers within three working days. The time goes into the controls: replacing an unsupported operating system, rolling multi-factor authentication out to every cloud service, proving a 14-day update routine across laptops, servers, routers and firewalls. For most organisations that is one to three months, and Plus must then be completed within three months of the Cyber Essentials certificate. We plan backwards from your deadline and track every fix in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the IT team, device and cloud inventories, network diagrams and, where there is one, the managed service provider |
| Remediation | The number of unsupported systems, lead times for replacements, change windows and the capacity of your IT team or provider |
| Self-assessment and certification | Evidence behind every answer, the check before submission, the board declaration and the assessor's review |
| Cyber Essentials Plus audit | The certification body's availability, the device sample, and any retest, which rechecks the original devices and a new random sample |
If the contract date is fixed, tell us at the start. Sometimes the fastest right route is a well-segregated sub-set first, if it covers what the contract needs, widened at renewal. A certificate date promised before anyone has looked at your devices is a guess, not a plan.
Challenges
Common Cyber Essentials implementation challenges
Cyber Essentials programmes run into the same five problems again and again. Each has a practical answer.
Unsupported software turns up inside the scope.
An old operating system on a shop-floor PC, a firewall past its support date, a browser extension nobody maintains: unsupported software anywhere in scope fails the assessment. We inventory every device and application first, then replace or upgrade it, or move it to a segregated network outside the scope.
Cloud services are missing multi-factor authentication.
Under Danzell, a cloud service that offers multi-factor authentication and does not use it is an automatic fail, and cloud services cannot be excluded from scope. We list every service your people sign in to, including those finance or marketing subscribed to themselves, and switch it on account by account.
The 14-day update window keeps slipping.
Critical and high-risk fixes have to land within 14 days on laptops, servers, the phones that reach company data, and router and firewall firmware. We turn on automatic updates wherever possible, define the routine for the rest and keep the reports that prove it runs.
Home working, personal devices and an outsourced IT provider blur the boundary.
Home-used and personal devices that reach organisational data are in scope, and the way a managed service provider reaches your systems has to be controlled. We decide with you what is allowed, managed or blocked, and write it into the scope statement.
The Plus audit fails on the sample.
One unpatched laptop or one account without multi-factor authentication in the sample can fail a test. Under Danzell a retest checks the original devices and a new random sample, and self-assessment answers can no longer be adjusted after the audit. We run the same tests across the estate first, not only on the devices likely to be sampled.
Your engagement
What your Cyber Essentials engagement includes
Your agreed scope brings together what a compliant estate and a prepared team need, from the first device inventory to the certificate and the renewal after it, from one team, under one all-inclusive proposal.
Scope, gap analysis and remediation plan
Level, legal entities and boundary agreed, every in-scope device and cloud service tested against the five controls, and fixes with owners and dates.
Policies and configuration standards
Firewall, secure build, update, account, malware and personal-device standards on Sterling's own template sets, adapted with your IT team.
Effivity ISO & GRC software
Your device and cloud-service registers, firewall approvals, update evidence and account reviews run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Answer check and declaration readiness
Every answer checked against its evidence, so the board member who signs the declaration knows what they are confirming.
Certification and Plus audit support
Help choosing a licensed certification body, support through marking and any fixes, and for Plus, rehearsal of the tests and support through the audit and any retest.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your Cyber Essentials implementation
Every Cyber Essentials engagement runs on Sterling OS™, our delivery operating system: five phases, each with deliverables, decision owners and evidence. Pick the support level your IT capacity calls for; the method, software and accountability do not change.
- 01Design™Guided implementation: your IT team makes the changes with Sterling's scoping method, configuration standards, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed remediation planning, documentation and evidence work alongside your IT team or provider.
- 03Sustain™Between certificates: periodic control checks, new devices and services brought into scope, new-starter training, and the renewal prepared before the certificate expires.
- 04Automate™The evidence running in Effivity: device and cloud-service registers, firewall approvals, update records, account reviews and renewal reminders in one workspace.
- 05Revise™Each annual question-set change, such as Danzell and requirements v3.3, the step up to Cyber Essentials Plus, and the extension to ISO/IEC 27001 or IASME Cyber Assurance.
At the start we agree the engagement team, the weekly working session, the deliverables and the decision owners, so a device that cannot be patched in time shows up in week two, not in the assessor's feedback.
How Sterling OS™ worksOften combined with
Standards organisations pair with Cyber Essentials
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
- DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.
Effivity · Cyber Essentials evidence software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of Cyber Essentials v3.3.
Every Sterling Cyber Essentials engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the scope statement, device and cloud-service registers, firewall approvals, update evidence, account reviews and renewal calendar sit in one place, and the answers your board signs rest on records anyone can open. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope, legal entities and exclusions
The scope statement, its legal entities, the network boundary and the areas left out, reviewed whenever the business changes, so each renewal starts from the current picture.
Firewall rules and their approvals
Every inbound rule with its business reason, approver and review date, rules no longer needed flagged for removal, and administrative interfaces recorded with their protection.
Device register and secure builds
Each in-scope device, home and personal ones included, with its owner, operating system and build standard, and checks that default passwords are changed and auto-run is off.
Update evidence against the 14-day clock
Critical and high-risk fixes logged with release and installation dates, late items raised as actions, and end-of-support dates tracked so nothing unsupported drifts back into scope.
Accounts, administrators and multi-factor authentication
Joiner and leaver approvals, administrator accounts listed and reviewed, and a cloud-service register showing where multi-factor authentication is enforced.
Protection status and allow-lists
The anti-malware or allow-listing method for each device type, status checks recorded, and exceptions followed up to closure.
Audit preparation and retests
The device sample, rehearsal results, the assessor's findings and the evidence of each fix, held together for any retest and next year's audit.
Certificate dates and question-set changes
Certificate expiry, the renewal plan and each year's requirement changes in one calendar, read before the next account is opened.
What this means at the audit
The Plus assessor tests what your self-assessment claims: the sampled laptop is patched, malware protection stops what the assessor tries to run, the cloud sign-in asks for a second factor, and the administrator does not browse the web from a privileged account. In Effivity the record behind each claim is a screen with dates, owners and evidence, not an export somebody pulls together the night before. After certification, Sustain™ works in the same workspace, so the renewal finds controls that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your registers, rules and records migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, BCMS, QMS and more when you add other standards
Cyber Essentials client experience
Client letters on file, available on request.
Signed client letters for Cyber Essentials are available on request. The client feedback wall lists every letter by standard.
Programmes with Cyber Essentials in scope
How an integrated cyber security programme runs.
- 01How integrated programmes run
Supplier to UK buyers: Cyber Essentials Plus on an ISO/IEC 27001 ISMS
Cyber Essentials is commonly implemented inside a wider information security programme, where the organisation holds or is working towards ISO/IEC 27001 and serves UK public-sector or regulated customers. In such a programme the five controls become the ISMS's technical baseline: the device inventory, update routine, access reviews and malware protection feed both the Annex A controls and the annual Plus audit, from one evidence base in one Effivity workspace.
Sterling Academy · Cyber Essentials e-learning
Train every employee on Cyber Essentials, not just the IT team.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the controls: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Cyber Essentials awareness for every employee: passwords, multi-factor prompts, updates, personal devices and reporting
- Practitioner courses for IT administrators, the security lead and the people who approve accounts and firewall rules
- Internal auditor training for the people who check the controls between renewals, as applicable to your standard, as part of the engagement
- Learner progress by department, and a training record to show buyers and insurers
- New starters trained as they arrive, so good habits keep pace with the workforce
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about Cyber Essentials
Watch a video on how to get Cyber Essentials certified here.
Watch a video on Cyber Essentials requirements here.
Why Sterling
Want successful Cyber Essentials certification? Come to Sterling.
Whether you certify one office or legal entities in several countries, Sterling helps you put the five controls on every device and service in scope and keep them there, through the practical conflicts: legacy systems the business depends on, cloud services bought outside IT, home workers on their own devices, and buyers who want Plus by a fixed date.
Management systems in 60+ countries since 2003
Information security, privacy and quality programmes implemented for technology firms, BPOs, manufacturers and service businesses, with one engagement team accountable for every entity and country in your scope.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with IASME and certification-body fees identified separately. No surprises, ever.
Controls your IT team can keep running
Configuration standards, update routines and account reviews built into the way your IT team or provider already works, so the controls are still there at renewal.
Expert and experienced consultants
Consultants who have advised on information security and other management systems across sectors and countries since 2003, and who prepare your estate properly the first time, so the assessor confirms controls that already work.
The Sterling Promise
What our Cyber Essentials certification success guarantee means
We stay with you until your agreed Cyber Essentials outcome is achieved at the level in your engagement, supporting remediation, the answer check, the assessment and any fixes or Plus retest the certification body asks for. Clear explanations, practical delivery, included software and employee learning turn the investment into controls that last, not a certificate that lapses.
The engagement identifies the level, the scope and legal entities, the outcome and the responsibilities. Your organisation supplies accurate information, gives access to the systems in scope, makes the agreed changes and answers truthfully, and a board member signs the declaration. The licensed certification body marks the assessment, conducts any Plus audit and makes the certification decision. Our commitment concerns the agreed certification support, not every future contract award or a year without incidents.
After certification
What happens after Cyber Essentials certification?
Your certificate records the state of your controls on the date it was issued, and it expires after 12 months. There are no surveillance audits in between. IASME sends a reminder roughly a month before renewal is due, and an organisation that has not certified in the past year drops off its list of certified organisations. The renewal is a new assessment against the question set in force when you open it, with every answer entered again, so keep a copy of this year's submission.
Between certificates the controls hold or decay: new laptops arrive, a team signs up to a cloud tool, an operating system reaches end of support. Under Sterling OS™ Sustain™ we check the controls with you through the year, bring new devices and services into the registers, and prepare the renewal and any Plus re-audit before the expiry date.
FAQs
Frequently asked questions about Cyber Essentials
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both certify the same five controls. Cyber Essentials is a verified self-assessment, signed as true by a board member and marked by a qualified assessor from a licensed certification body. Plus adds a hands-on technical audit: a remote vulnerability assessment, an authenticated scan of sampled devices, and checks of malware protection, multi-factor authentication and account separation, within three months of the Cyber Essentials certificate and on the same scope.
Is Cyber Essentials mandatory for UK government contracts?
For many of them. PPN 014, for procurements started from 24 February 2025, requires central government departments, their agencies and non-departmental public bodies and NHS bodies to apply it to contracts involving citizens' or government employees' personal data, or ICT systems and services handling OFFICIAL data. A supplier without the certificate must show equivalent controls by other means, and certification is renewed every year of the contract. Defence suppliers follow Def Stan 05-138: Cyber Essentials at every risk level, Plus from Level 1.
How long is a Cyber Essentials certificate valid?
Twelve months, at either level. The certificate describes your controls at a point in time, defined by the scheme as the date of issue, so renewal is a fresh assessment each year. Buyers can check that a certificate is current on the NCSC certificate search, which lists those issued in the last 12 months.
Can we certify only part of the organisation?
Yes, if that part is a well-defined, separately managed sub-set whose network is segregated from the rest by a firewall or VLAN, and the scope is agreed with the certification body beforehand. End-user devices must be included and cloud services cannot be excluded. Under Danzell you name every legal entity in scope and describe what is left out; the exclusions are not published. The included cyber liability insurance applies only when the whole organisation is certified.
Which questions are automatic fails, and what happens if we fail?
Unsupported software anywhere in scope fails the assessment. Under Danzell, so does a cloud service without multi-factor authentication where it is available, and a critical or high-risk update not applied within 14 days to operating systems and router or firewall firmware (question A6.4) or to applications (A6.5). The assessor's report explains every non-compliant answer, and IASME allows two working days to fix simple issues and update the answers without a further fee.
Willow or Danzell: which question set applies to us?
It depends on when the assessment account was created. Accounts created from 27 April 2026 use Danzell and requirements v3.3; earlier accounts can finish under Willow and v3.2 within six months of creation, so the last of those windows closes in late October 2026. The scheme is reviewed every year, so check the current set before opening a renewal account.
We are certified to ISO/IEC 27001. Do we still need Cyber Essentials?
If a buyer or contract names Cyber Essentials, usually yes. ISO/IEC 27001 certifies a risk-based management system, with controls selected through your own risk assessment; Cyber Essentials certifies five specific technical controls, pass or fail, on every in-scope device. PPN 014 allows equivalent controls shown by other means, but acceptance is the buyer's decision. Your ISMS makes certification quicker.
Does Sterling issue the Cyber Essentials certificate?
No. Sterling is a consultancy, not a certification body. We prepare your organisation, check the evidence and support you through the assessment; a certification body licensed by IASME marks the self-assessment, conducts any Plus audit and issues the certificate. A provider offering to fill in your answers and hand you a certificate is offering a declaration your board cannot accurately sign.
We are based outside the UK. Can we get Cyber Essentials?
Cyber Essentials is a UK government scheme; IASME describes it as the minimum standard for organisations in the UK and Crown Dependencies, where its certification bodies are based. Certification bodies also assess organisations elsewhere, with the self-assessment online and any Plus audit on site or remote; confirm the certification body will certify your legal entity before you plan around a date. The included insurance covers only organisations domiciled in the UK or Crown Dependencies.
What do you need to prepare a Cyber Essentials proposal?
The level you need and why, the legal entities and locations involved, the number of users and devices, your cloud services, whether IT is run in-house or by a provider, any previous certificate, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to start the self-assessment first.
Before the first call
Prepare a useful Cyber Essentials readiness brief
You do not need an assessment account before the first discussion. Bring a short account of your IT estate and who is asking. Seven questions are enough:
- Who is asking for Cyber Essentials, at which level, for which legal entity and by when? Or, if nobody has asked, what do you most want to protect?
- How many users, laptops, desktops, servers, phones and tablets reach company data, and who owns those devices?
- Which cloud services hold your data or run your business, and which of them use multi-factor authentication today?
- Is anything still running an operating system or application that no longer receives security updates?
- How are updates, new accounts, leavers and administrator rights handled now, and by whom: your own IT team or a provider?
- Where does your network meet the internet: offices, home workers, remote access, hosted servers?
- Is there an existing certificate, an expiry date or a contract start date to plan around?
These answers let us scope the work and price it realistically. They prepare a conversation; they are not a scored assessment and not a certification decision.
Don’t be fooled by certification scams
If the answers are not true, it is not Cyber Essentials certification.
A Cyber Essentials certificate is worth having when the controls it describes are really in place and the certificate can be found on the NCSC certificate search. The market also sells substitutes: questionnaires completed by someone who has never seen your network, badges with no certificate number behind them, and "Cyber Essentials compliant" documents from firms with no licence to certify. They cost less, until a buyer searches for your certificate or an incident shows the controls were never there.
How to choose a credible Cyber Essentials provider
- Ask which certification body will assess and confirm on IASME's list that it is licensed; only a licensed certification body can issue the certificate.
- Check any certificate on the NCSC certificate search, by organisation name or certificate number, and confirm the level, the certification date and the expiry date.
- Ask how each answer will be verified before submission. A board member signs that the answers are true, so a consultant's guess becomes your organisation's declaration.
- Identify who carries each task, which fees belong to IASME and the certification body, and what support exists if the assessor fails an answer or a Plus test.
- Ask what your people will learn and where the evidence will live. The certificate lasts 12 months; without training and records, every renewal starts from zero.
- Walk away from "guaranteed pass", "we answer the questions for you" and certificates without a number you can look up. The scheme certifies controls that operate, not paperwork.
Keep exploring
More on Cyber Essentials and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your Cyber Essentials certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice