Cyber Essentials is assessed at a point in time, but the declaration you sign says you will keep every control running for the whole certification period. Staying compliant means watching a short list continuously: patch age, supported software, MFA on cloud services, device configuration, admin access and malware protection.
Why is a point in time assessment not enough?
IASME, the scheme's delivery partner, states that the assessment reflects the date the certificate is issued, so systems must be supported on that date. It also says the board or director declaration now acknowledges a duty to maintain all controls throughout the certification period.
That gap is where most drift happens. A laptop gets re-imaged without the standard settings. A contractor gets a cloud admin account without MFA. A router sits unpatched for a month because the person who owned it left.
Which rule is easiest to break?
The patch rule. The NCSC requirements for IT infrastructure (version 3.3, April 2026) say software on in-scope devices must be licensed and supported, removed when it becomes unsupported, have automatic updates enabled where possible, and be updated within 14 days of release when the fix addresses vulnerabilities the vendor calls critical or high risk, or a CVSS v3 base score of 7 or above, or when the vendor gives no severity detail.
IASME's April 2026 update marks two questions on this as auto-fail: updates for operating systems and router or firewall firmware, and updates for applications including associated files and extensions. Missing either fails the whole assessment, whatever else you scored.
A caution from the NCSC text matters here. Some vendors bundle several fixes into one update. If any of them is critical or high, the whole update falls under the 14 day window.
What should you actually monitor?
Map each of the five technical controls the NCSC lists to one number you can read at any time.
- Firewalls: list of open inbound rules, with an owner and a reason for each.
- Secure configuration: count of devices that differ from your baseline, and any default passwords still in use.
- Security update management: oldest unapplied critical or high update, in days, per device group.
- User access control: admin accounts, and the share of cloud services with MFA switched on. IASME says MFA is mandatory where a cloud service offers it, free or paid, and missing it is an automatic failure.
- Malware protection: devices where protection is off or out of date.
None of this needs a special platform. A spreadsheet refreshed weekly beats a dashboard nobody opens. The point is that each number has a named owner and a threshold that triggers action.
What about the software you build?
Cyber Essentials scope covers devices and the software on them, not the open-source packages inside products you ship. But many small firms that certify also build software, and the same habit applies: know what you run, know its age, fix what is exploited. If you ship code, tools that produce an SBOM and match it to known vulnerabilities (Safeguard does this, including reachability analysis) give you that inventory as a by-product. Treat it as a separate control from the scheme, not a replacement for any of its five.
What to do
- Write down your certification date and set a calendar reminder for six weeks before it lapses, so renewal is not a scramble. Check the exact validity period with your certification body, because the NCSC and IASME pages we fetched do not state it.
- Assign one owner per control and one number per owner, using the list above.
- Review the oldest critical or high update weekly. Anything past 10 days gets escalated.
- Remove or isolate unsupported software before it becomes a finding.
- Audit cloud admin accounts monthly for MFA, including contractors.
- After every new office, device type or cloud service, check whether scope changed, and update the description.
- Keep a dated log of what you checked. It is your evidence if the scope or the answers are questioned.
Quick check
Does the certificate prove my controls are working today?
No. It shows the controls were in place when the assessment was made. The declaration you sign commits you to maintain them for the certification period, so you need your own checks.
Do all updates need to be applied within 14 days?
The mandatory rule covers updates that fix critical or high risk vulnerabilities (CVSS v3 base score 7 or above, vendor rated critical or high, or no severity given). The NCSC strongly recommends, but does not require, applying all updates within 14 days.
Sources
- NCSC: Cyber Essentials overview, fetched 18 October 2026
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3, fetched 18 October 2026
- IASME: Changes to Cyber Essentials for April 2026, fetched 18 October 2026
Safeguard does not hold or issue Cyber Essentials certification. This post explains the scheme and makes no claim about Safeguard.
Last reviewed: 18 October 2026.
