Cyber Essentials Explained

Cyber Essentials is a UK government-backed certification scheme that requires organisations to implement five specific security controls against common internet-based attacks. If you're evaluating whether it applies to your organisation, or preparing for an audit, this guide covers what the controls actually require, how certification works, and where most IT teams run into trouble.

What Cyber Essentials Covers

The scheme was developed by the UK's National Cyber Security Centre (NCSC) and is designed to protect against the most prevalent attack vectors: phishing, credential stuffing, exploitation of unpatched software, and misconfigured network services. It is not a comprehensive risk management framework like ISO 27001. It is a baseline, and that is intentional.

Cyber Essentials applies to any organisation operating in the UK, regardless of size or sector. It is mandatory for UK central government contracts involving the handling of personal data or certain technical services. Many supply chain procurement processes in defence, healthcare, and financial services also require it as a condition of doing business.

There are two certification levels:

• Cyber Essentials: Self-assessed questionnaire, verified by an accredited certifying body
• Cyber Essentials Plus: Adds a technical audit conducted by an assessor who tests your controls directly

Cyber Essentials Plus is more rigorous. The assessor will run vulnerability scans, attempt to exploit misconfigured services, and verify that your device configurations match what you declared in the self-assessment. Many organisations discover gaps at this stage that their self-assessment missed.

The Five Technical Controls

The entire scheme is built around five control areas. Understanding what each one requires in practice is where the real preparation work begins.

1. Firewalls

All devices must be protected by a correctly configured firewall. For boundary firewalls, this means blocking all inbound connections that have not been explicitly permitted. For individual device firewalls, the default profile must block unapproved inbound traffic. The NCSC's Cyber Essentials requirements document specifies that any service not required for business purposes must be disabled.

In practice, this means auditing every open port across your fleet, not just your network perimeter. A developer's Mac running a local web server on port 8080 with no host-based firewall rule blocking inbound access on that port is a finding under Cyber Essentials.

2. Secure Configuration

Devices must be configured securely before deployment and maintained in that state. The control requires:

• Removing or disabling unnecessary software, accounts, and services
• Changing default credentials on all accounts
• Disabling auto-run features for removable media
• Applying a minimum-security baseline to the operating system and installed software

This is where endpoint hardening becomes directly relevant. Meeting secure configuration at scale means you need a repeatable, automated way to push and verify configuration profiles across every managed device, not a checklist that relies on individual admins doing it manually.

3. User Access Control

User accounts must follow least privilege principles. Specifically:

• Standard user accounts for day-to-day activity
• Administrative accounts used only for administrative tasks
• No shared accounts
• All accounts protected by strong authentication
• Removal of accounts that are no longer required within a defined timeframe

The Cyber Essentials Plus assessment will test this. Assessors look for accounts with unnecessary privileges and will check whether administrative access is scoped correctly.

4. Malware Protection

All in-scope devices must have malware protection active and up to date. The NCSC accepts three approaches:

• Signature-based anti-malware with automatic updates
• Application allowlisting that prevents execution of unauthorised software
• Sandboxing to isolate untrusted applications

For macOS and iOS environments, this control intersects with Apple's own security architecture. Gatekeeper, XProtect, and Notarization provide a layer of malware protection that the NCSC recognises, but you still need to document that these are active and enforced across the fleet. On devices where you need more active threat detection, understanding the difference between EDR vs antivirus is worth the time before choosing your tooling.

5. Patch Management

Software must be licensed, supported, and patched within 14 days of a security update being released. This 14-day window applies to the operating system and all applications installed on in-scope devices. Any software that is no longer supported by its vendor must be removed.

This is the control that most organisations underestimate operationally. Fourteen days is a tight window when you factor in testing cycles, patch rollout to a distributed workforce, and chasing down the one machine that has been offline for three weeks. An effective approach to CVE prioritization and remediation helps you triage what to patch first and document that you did it within the required timeframe.

What Is In Scope for Cyber Essentials

Scope is one of the more consequential decisions in the certification process. The standard applies to all devices that can access organisational data or services. That includes:

• Laptops, desktops, and mobile devices used for work
• Cloud-hosted infrastructure where you are responsible for the operating system
• BYOD devices accessing corporate email or data

If personal devices connect to corporate resources, they are in scope unless you have a technically enforced boundary, such as a mobile application management solution that prevents corporate data from touching the device's file system. Understanding your BYOD device management posture is essential before you draw your scope boundary.

Cloud services where the provider manages the infrastructure (true SaaS platforms) are generally out of scope, but the devices users access them from are still in scope.

Cyber Essentials vs. Cyber Essentials Plus: Which One Do You Need

For most commercial organisations pursuing it for procurement reasons, Cyber Essentials is sufficient. Cyber Essentials Plus is worth pursuing if:

• You handle sensitive government data or hold contracts that mandate it
• You want a credible signal to enterprise customers that your controls are independently verified
• You are using it as a stepping stone toward ISO 27001 and want to establish auditable control evidence early

The cost difference is material. Cyber Essentials self-assessment fees run from a few hundred pounds for small organisations. Cyber Essentials Plus involves external assessor time and typically costs several thousand pounds, depending on organisation size and scope.

Common Failure Points in Cyber Essentials Assessments

Based on common patterns in Cyber Essentials Plus assessments, these are the controls where organisations most often have unexpected findings:

1. Patch management gaps on end-user devices: Machines that have been offline or in storage accumulate missing patches. A single non-compliant device in scope is a failure.

2. Firewall misconfiguration on remote worker devices: Home routers often do not provide the host-based firewall coverage the standard requires. The device's own firewall must be correctly configured.

3. Shared local administrator accounts: A common finding on Windows environments where a shared local admin account with a known password exists across the fleet.

4. Unmanaged software on user machines: Applications installed outside of a managed software catalogue that are out of date or end-of-life.

5. BYOD scope disputes: Organisations that assumed personal devices were out of scope but had not technically enforced the data boundary.

How Iru Approaches Cyber Essentials

Cyber Essentials requires two things in parallel: enforcing the five controls on every in-scope device, and producing evidence that those controls are active and maintained. Handling those separately creates overhead and audit risk.

Iru Endpoint enforces the device-level controls that Cyber Essentials requires. Configuration profiles push and maintain secure baselines across your macOS, iOS, and iPadOS fleet from day one. Patch management policies enforce OS and application updates within your defined window, with fleet-wide visibility into compliance status so you can identify non-compliant devices before an assessor does. Hardware inventory management gives you a current, accurate record of every device in scope, which is the starting point for any Cyber Essentials scope definition.

Iru Compliance maps your Cyber Essentials controls and collects evidence automatically. Rather than manually pulling screenshots of configuration settings before each audit, Iru Compliance continuously monitors control status and surfaces gaps as they appear. When your assessor asks for evidence that patch management is applied consistently, the audit trail is already there.

The combination matters because Cyber Essentials Plus assessors verify that your declared controls are actually in force. If your enforcement tool and your evidence tool are different systems, the gap between them is where audit risk lives.

Choosing the Right Path to Cyber Essentials Certification

Cyber Essentials is achievable for most organisations within a few months if the five controls are treated as an implementation project rather than a paperwork exercise. Start by scoping accurately, then assess your current configuration against each control, remediate gaps, and establish ongoing monitoring before you submit for assessment.

For organisations already running a device management platform, the delta is often smaller than expected. The bigger challenge is operationalising the 14-day patch window and generating the evidence to prove it at audit time.

Cyber Essentials certification becomes easier when control enforcement and evidence collection live in the same place. Iru offers device management and compliance as separate products or together, whichever matches where you are today.