Cyber Essentials is a UK government recommended certification scheme, developed by the NCSC, that sets a baseline of cyber security around five technical controls. You probably need it if customers or tenders ask suppliers for it. It suits organisations of any size, and Cyber Essentials Plus adds independent technical testing.
What are the five controls?
The NCSC overview names them: firewalls, secure configuration, security update management, user access control and malware protection. They are chosen to block the most common internet based attacks, not every attack. That is the point of a baseline. It is deliberately short.
Think of the five as a checklist for the basics a small company often skips because nobody owns it. Who can log in to what? Which laptops have not been updated in months? Is there a default password on that router?
What is the difference between Cyber Essentials and Plus?
Standard Cyber Essentials combines a self assessment with an independent audit of your answers. Cyber Essentials Plus applies the same five controls but adds independent technical testing to verify they work in practice. The NCSC describes Plus as higher assurance.
Put simply: the standard level asks you to say what you do and have that checked. The Plus level has someone test it.
Who actually needs it?
The NCSC page does not make it mandatory for every business. It says the scheme is recommended for organisations of all sizes, and notes that a growing number of organisations require suppliers to hold certification before they can bid for work. So the practical test is commercial, not legal:
- Look at the last five tenders or customer questionnaires you received. Did they ask for it?
- Ask your largest customers whether they will.
- Check whether your cyber insurer asks about it.
If the answer is yes to any of those, certification is likely worth doing. If none apply, the five controls are still worth adopting on their own.
What does it cost?
The NCSC page says Cyber Essentials starts at 320 pounds plus VAT and is priced by organisation size. Cyber Essentials Plus is quoted based on the size and complexity of your network. These figures come from the NCSC overview page we fetched on 18 October 2026 and can change. Certification bodies set their own fees, so confirm with them.
What should you do first?
- Decide the scope: which offices, devices, cloud services and people are in.
- Read the current requirements document. The NCSC lists v3.3 as effective from 27 April 2026, and says applications started before that date can keep following v3.2.
- Inventory devices and software, including the ones staff bought themselves.
- Turn on automatic updates and write down who owns patching.
- Remove accounts that nobody uses and enforce the access rules the requirements ask for.
- Choose a certification body and book the assessment.
- Decide now whether you want Plus, since customers sometimes ask for it by name.
How does this relate to software supply chain security?
Cyber Essentials is about your own devices and accounts. It does not examine the open source libraries inside the software you build. If you ship software, you will likely face questions about dependencies as well, and a scheme like this will not answer them. Safeguard is a platform for that second problem. It does not issue or hold Cyber Essentials certification, and it does not make an organisation certified.
Quick check
Is Cyber Essentials a legal requirement?
The NCSC page presents it as recommended, and says a growing number of organisations require it from suppliers. It does not describe a universal legal duty.
Which level should a small supplier choose?
Start with what the customer or tender asks for. If nothing specific is required, standard Cyber Essentials is the lower cost route, and Plus can follow later.
Sources
Last reviewed: 18 October 2026.
