Cyber Essentials certification in the United Kingdom

Cyber Essentials certification in the UK at a glance

Five technical controls sit at the centre of Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection. Developed by the NCSC as the minimum standard of cyber security the Government recommends, the scheme is delivered through IASME and its network of licensed certification bodies. Cyber Essentials combines a verified self-assessment, signed off by a board member or equivalent, with marking by an assessor; Cyber Essentials Plus adds technical testing to confirm the controls work in practice. Public buyers give the scheme real weight. Under PPN 014, central government departments, their agencies and NHS bodies must ensure suppliers on contracts handling citizens' or officials' personal information, or OFFICIAL-level ICT, meet technical requirements, most quickly through Cyber Essentials or Cyber Essentials Plus, renewed annually, or equivalent controls. Sterling's London office runs readiness reviews, closes gaps in patching, configuration and access, and prepares evidence for the certification body, which makes the award.

Who needs Cyber Essentials in the UK, and what happens without it

In the UK the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.

• Suppliers to central government departments, agencies, NDPBs and NHS bodiesPPN 014 asks for Cyber Essentials, Cyber Essentials Plus or equivalent controls on contracts handling personal information or OFFICIAL data.
• IT managed, outsourced and ICT service providersPPN 014 lists them among contract types where the scheme may be relevant.
• Small and medium-sized businesses processing personal dataThe ICO calls Cyber Essentials a good starting point for security under the UK GDPR.
• Organisations whose customers require certified suppliersThe NCSC notes that a growing number of organisations require suppliers to be certified to bid for work.

Cyber Essentials requirements in the UK

Strip away the vocabulary and Cyber Essentials asks an organisation to prove six things about its defences against common cyber attacks.

In the UK these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Cyber Essentials explained →

How to get Cyber Essentials certified in the UK

One team from the London office carries the work from scoping to certificate. England, Scotland, Wales and Northern Ireland, on-site from London; remote delivery for distributed teams.

1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
2. Gap assessment against Cyber Essentials and the UK requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
5. Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

How long does Cyber Essentials certification take in the UK?

There is no standard duration: it depends on your scope and on how much of the system already runs. In the UK these are the factors that set the timeline.

• Size of the device and cloud estate in scope
• Unsupported software and patching backlog
• Whether the whole organisation or a sub-set is certified
• Choice between Cyber Essentials and Cyber Essentials Plus

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

• Scope and timeline estimator

How much does Cyber Essentials certification cost in the UK?

The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In the UK these factors move both.

• Organisation size, which sets the certification fee tier
• Network complexity for Cyber Essentials Plus testing
• Replacement of unsupported devices or software
• Certification body fees, separate from consulting

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

Cyber Essentials consultants and certification bodies in the UK

Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

• Check that the body’s accreditation or approval covers Cyber Essentials and your sector, and that its certificates can be verified online.
• Ask the consultant how the local requirements in the UK are mapped into the same system, so nothing runs twice.
• Ask for client references in your sector; Sterling’s client letters are available on request.
• Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

Cyber Essentials in the UK: questions clients ask

More on Cyber Essentials for UK organisations

• Cyber Essentials: the complete guide
• Watch: How to get Cyber Essentials certified
• Sterling in London
• Cyber Essentials certification in the UK and every other standard Sterling delivers there

Other standards UK businesses ask Sterling for

Organisations in the UK often combine Cyber Essentials with one of these, under one management system where the scopes allow.

All 23 standards Sterling delivers in the United Kingdom →