Cyber Essentials is a UK government backed certification scheme built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. A DevOps lead can scope it to the devices and cloud services in use, then meet each control with settings that leave evidence.
What is Cyber Essentials?
The National Cyber Security Centre describes it as a scheme aligned to five technical controls designed to prevent the most common internet based threats. There are two levels. Cyber Essentials combines a self assessment with an independent review. Cyber Essentials Plus covers the same controls with independent technical testing to verify they work in practice. Some government and supplier contracts require certification. The NCSC's page links to the delivery partner, IASME, for the process and costs, which change over time.
How do the five controls map to a modern stack?
A constructed example for a 25 person SaaS company with laptops, SaaS tools and a cloud account:
- Firewalls: host firewalls on every laptop, restrictive security groups in the cloud account, no administration ports open to the internet, a router with default credentials changed.
- Secure configuration: remove unused accounts and software, set sensible defaults, enforce screen lock and disk encryption by device management, and change default passwords.
- Security update management: automatic operating system updates, a rule for browser and application updates, and a process for patching servers and containers within the timescale the scheme specifies. Check the current requirements document for the exact deadline for high risk fixes.
- User access control: separate admin and daily accounts, MFA on cloud services, removal of leavers the same day, no shared accounts.
- Malware protection: anti malware or application allow listing on devices, and controlled sources for software installation.
What counts as in scope?
Scope is the set of devices, networks and services used to run the business within the boundary you declare. Cloud services such as email, code hosting and the cloud console are in scope, and the scheme's requirements document explains how responsibility is shared with the provider. Personal devices used for work can be in scope too. A smaller declared scope is easier to defend, but customers may want it to cover the whole organisation.
Where do DevOps teams stumble?
Usually in four places: unmanaged devices that nobody listed, old container base images and servers that skip patching, shared admin credentials for a cloud console, and forgotten SaaS accounts of former staff. Inventory first. You cannot patch what you do not know exists.
How does this help beyond certification?
The five controls are a baseline that most larger frameworks also expect. If you later pursue ISO 27001 or SOC 2, the evidence you build here carries over: device inventory, patch records, access lists and MFA enforcement.
Safeguard's dependency and container scanning can add visibility into vulnerable components in software you ship. It is separate from the device and office controls the scheme tests.
What to do
- Download the NCSC question set and requirements for IT infrastructure.
- List every device, cloud account and SaaS service in scope.
- Enforce updates, disk encryption and firewalls through device management.
- Turn on MFA for all cloud and admin accounts and remove shared logins.
- Close management ports and review inbound rules in each cloud account.
- Patch servers and base images on a schedule, and keep logs of it.
- Decide whether you need Plus, and plan for the technical test if so.
Quick check
What is the difference between Cyber Essentials and Plus?
Both assess the same five controls. Plus adds independent technical testing that verifies the controls work in practice.
Do cloud services count?
Yes, cloud services used by the organisation are in scope. The requirements document explains how responsibility is shared with the provider.
Sources
Last reviewed: 18 October 2026.
