Cyber Essentials uses a small vocabulary: five technical controls, a self assessment, an independent audit, a Plus level with technical testing, and a numbered requirements document. This glossary explains each term in plain language, using the NCSC's own pages, so you can read an assessment form without a translator.
The scheme
Cyber Essentials. A UK government recommended certification scheme developed by the NCSC. It sets a baseline of cyber security for organisations of any size.
NCSC. The National Cyber Security Centre, the UK body that developed the scheme and publishes its requirements.
Certification body. The company that runs your assessment and issues the certificate. You pick one. They set their own fees.
Self assessment. The questionnaire you complete about how your organisation meets the controls. It is checked by an independent audit.
Independent audit. A review of your self assessment answers by someone outside your company.
Cyber Essentials Plus. The same five controls, with independent technical testing added to check they work in practice. Higher assurance than the standard certificate.
The five technical controls
Firewalls. Software or hardware that decides which network traffic is allowed in and out.
Secure configuration. Setting devices and software up safely rather than leaving defaults. Changing default passwords is a typical example.
Security update management. Keeping operating systems, apps and firmware patched. This is the control that most often catches organisations with old laptops.
User access control. Making sure only the right people have accounts, and that those accounts have only the access they need.
Malware protection. Measures that stop malicious software running on your devices.
Words on the assessment form
Scope. The part of your organisation covered by the certificate: which sites, devices, services and people. A narrow scope is easier to certify, but customers may ask why you left something out.
Requirements document. The NCSC document that sets out the requirements for each of the five controls. The NCSC lists v3.3 as the current version, effective from 27 April 2026. Applications started before that date can continue with v3.2.
Test specification. The document that describes how Cyber Essentials Plus testing is carried out. The NCSC lists a v3.2 test specification dated 28 April 2025.
Cloud service. A service you use over the internet, such as email or file storage. Check the requirements document for how your own cloud services are treated.
Device. Any laptop, phone, server or similar equipment that touches your data.
Patch. A software update that fixes a security flaw. Related term: vulnerability, meaning the flaw itself.
MFA. Multi factor authentication, a login that needs more than a password. Check the requirements document for where it is asked for.
Terms that trip people up
Baseline. A minimum level, not a ceiling. The NCSC describes the scheme as a baseline of cyber security, which means passing it does not mean you are safe from every attack. It means the most common internet based attacks are harder.
Assurance. How much confidence a reader can place in the certificate. The NCSC describes Plus as higher assurance because someone tests the controls instead of only reviewing answers.
Supplier. A company that sells to you, or that you sell to. Customers who ask their suppliers for certification are using the scheme as a way to check the basics across their own supply chain.
Renewal. Ask your certification body how long a certificate lasts and how renewal works, and check which version of the requirements applies when you start.
How do you use this?
- Read the five control definitions first. Most of the form maps to them.
- Write your scope in one paragraph before you open the questionnaire.
- Keep the requirements document version in your notes, so you know which wording applies to you.
- Ask your certification body whether a term in the form is ambiguous for your setup.
This glossary is a reading aid. It is not the requirements document and it does not replace it. Safeguard does not hold or issue Cyber Essentials certification.
Quick check
What are the five Cyber Essentials controls?
Firewalls, secure configuration, security update management, user access control and malware protection.
What does Plus add?
Independent technical testing of the same five controls, to verify they work in practice.
Sources
Last reviewed: 18 October 2026.
