Cyber Essentials does not mention SBOMs, but several of its five controls depend on knowing what software you run and keeping it current. Security update management and user access control map most directly to supply chain practice: inventory, supported versions, a 14 day fix window for serious flaws, and MFA on cloud services.
This post explains the scheme. It is not legal or audit advice, and no tool or vendor certifies you. Certification comes from an assessment under the scheme.
What is Cyber Essentials?
It is a UK scheme developed by the National Cyber Security Centre. The NCSC lists five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials combines a self-assessment with independent review, and Cyber Essentials Plus adds independent technical testing. IASME is the delivery partner that runs registration and the self-assessment process.
The technical rules sit in "Requirements for IT Infrastructure", version 3.3, dated April 2026. We read that document directly for this post.
Which control maps to supply chain work most directly?
Security update management. The v3.3 text says all software on in-scope devices must:
- be licensed and supported,
- be removed when it becomes unsupported, or kept out of scope with a defined sub-set that blocks all traffic to and from the internet,
- have automatic updates enabled where possible,
- be updated, including vulnerability fixes, within 14 days of release when the update fixes issues the vendor calls critical or high risk, when the CVSS v3 base score is 7 or above, or when the vendor gives no severity detail.
It adds a caution: if one update bundles several fixes and any is critical or high risk, the whole update falls under the 14 day rule.
"Licensed and supported" has a precise meaning. The vendor must have committed to regular vulnerability fixes and must provide the future date when support stops. That is a supply chain question. Do you know the end of support date for every operating system, runtime and application on your devices?
What about the rest?
User access control. The text calls for MFA where available, and says authentication to cloud services must always use MFA. It also asks for separate accounts for administrative work and removal of special privileges when no longer needed. Source code hosts, package registries, CI systems and cloud consoles are cloud services in this sense if they hold your organization's data, so protect those accounts first.
Secure configuration. Fewer ways in. For developers, that means removing unused packages and services from machines and build agents.
Malware protection. A poisoned dependency is malware on a developer laptop. Install-time script controls and package vetting help here, though the scheme does not prescribe them.
Firewalls. Less directly connected to supply chain, except for build agents that can reach the whole internet.
What does the scheme not cover?
It scopes devices, cloud services and the software on them. It does not examine the open source components inside software you write and ship. If your customers ask for SBOMs or component level risk, that lives in other frameworks such as NIST guidance or customer contracts. A Cyber Essentials certificate is evidence of baseline hygiene, not of component level assurance.
Where does tooling fit?
An inventory feeds the update rules. Safeguard's SBOM generation and software composition analysis produce a component inventory for your code, and its compliance automation maps findings to frameworks. For Cyber Essentials the closest use is evidence gathering about vulnerable or unsupported components, not certification. Devices, operating systems and SaaS accounts need their own tooling.
What to do
- Define scope: which devices, cloud services and accounts access organizational data, including BYOD.
- Build a list of installed software with vendor support end dates, and mark anything unsupported.
- Remove unsupported software, or isolate it from the internet in a defined sub-set.
- Turn on automatic updates and set an internal alert at day 10 for open critical or high fixes.
- Treat CVSS 7.0 or above, or vendor wording of critical or high risk, as the trigger for the 14 day clock.
- Enforce MFA on every cloud service, starting with your code host, CI and registry accounts.
- Keep update reports as evidence for the assessor.
Quick check
Does Cyber Essentials require an SBOM?
Not in the v3.3 requirements we read. It requires supported software, timely fixes and access controls on in-scope devices and cloud services.
How fast must critical updates be applied?
Within 14 days of release for updates fixing critical or high risk issues, which includes CVSS v3 scores of 7 or above.
Sources
- NCSC Cyber Essentials overview
- Cyber Essentials: Requirements for IT Infrastructure v3.3 (NCSC, PDF)
Last reviewed: 18 October 2026.
