Cyber Essentials is a UK government backed scheme that checks an organisation's IT against five technical controls. It does not certify your product. A product manager should know the scope, because buyers and sales teams often ask for it when a public sector or large enterprise deal appears.
What is Cyber Essentials?
The National Cyber Security Centre calls it the minimum standard of cyber security recommended by the UK Government for organisations of all sizes. It was developed by the NCSC, and the certification scheme is aligned to five technical controls aimed at the most common internet based attacks. The NCSC also notes that a growing number of organisations require suppliers to be certified to bid for work.
What are the five controls?
- Firewalls: a security filter between the internet and your network.
- Secure configuration: computers set up to minimise ways in.
- Security update management: stopping attackers using known software flaws as an entry point.
- User access control: who can reach your data and services, and with what level of access.
- Malware protection: identifying and stopping malicious software.
Notice that these are about how your company runs its own laptops, servers and accounts. A product with a flaw in its checkout flow can still sit inside a certified company.
Where does it touch the product?
Constructed example: a product manager at a 40 person software company is told a university will only sign if the company holds Cyber Essentials. Three product adjacent questions come up.
Staff access to production. The user access control requirement asks about who has admin rights. Support engineers with standing admin on customer environments are a talking point.
Update management. The company's own build machines, laptops and cloud servers need timely updates. This is separate from your product's patch cadence, though auditors may ask about both.
Cloud services. The company's cloud accounts used to run the product count as part of its IT estate. Ask your IT lead what the scope statement says.
How do you certify?
The NCSC describes two routes. In the self led route the company registers through IASME, pays, completes a verified self assessment signed off by a board member or equivalent, and an assessor marks it. In the supported route the company hires a certification body licensed by IASME to help understand and answer the questions. There is also Cyber Essentials Plus, which keeps the same protections but adds rigorous independent technical testing. Free resources include the question set, a readiness tool and a free consultation with a Cyber Advisor for small and medium businesses.
What should a PM do about it?
Do not promise customers that the product is Cyber Essentials certified. Say the company holds the certificate, if it does, and give the scope. If a customer wants product level assurance, point to your security documentation and vulnerability handling instead.
The scheme does include update management, and for the software you ship, knowing your own dependencies is a related habit. Safeguard can produce an SBOM and scan dependencies, and the free browser scan at gold.safeguard.sh/scan checks up to 100 dependencies. That helps with product questions that Cyber Essentials does not cover.
What to do
- Ask sales which deals mention Cyber Essentials and which level they want.
- Read the NCSC question set, even if IT owns the certificate.
- Confirm the scope statement with IT and keep a copy.
- Fix internal admin access patterns that would fail the access control questions.
- Write a plain sentence for customers: what the certificate covers and what it does not.
- Prepare separate product security evidence for deals that need it.
Quick check
Does Cyber Essentials certify my software product?
No. It checks an organisation's IT against five controls. Product security needs its own evidence.
Who signs off the self assessment?
A board member or equivalent signs off the answers, and an assessor then marks them, per the NCSC overview.
Sources
Last reviewed: 18 October 2026.
