Automate Cyber Essentials readiness with adaptive compliance

Cyber Essentials is a UK government-backed, industry-supported scheme overseen by the National Cyber Security Centre (NCSC)

Cyber Essentials evaluates five technical controls designed to prevent the most common internet-based cyber threats: firewalls, secure configuration, security update management, user access control, and malware protection

Cyber Essentials is a verified self-assessment. You choose one of two routes: self-led, where you complete the assessment yourself, or supported, where you pay for support from a Cyber Advisor or Certification Body.  Either way, your answers must be signed off by a board member or equivalent, then marked by an assessor.

Cyber Advisors are cyber security professionals who have passed an independent assessment covering the five technical controls and hands-on implementation support for smaller organisations. They help you put the controls in place — they don't mark your assessment or issue your certificate. Some companies hold both statuses, so the same firm can support you and then certify you, but the two roles stay separate.

Cyber Essentials Plus builds on the same five technical controls, but adds independent technical testing to verify the controls are actually in place. If the Cyber Essentials Plus audit is completed within three months of the Cyber Essentials certification, you do not need to re-do the self-assessment. 

Testing covers a representative sample of end user devices, your internally hosted servers, and your cloud services — IaaS, PaaS, and SaaS alike. Assessors run an external vulnerability scan, an authenticated patch scan, malware protection tests, multi-factor authentication checks on every cloud service, and account separation checks.

The output of a Cyber Essentials engagement is a Cyber Essentials certificate, which names the scope it covers — whole organisation or a defined sub-set. These are typically shared with customers and prospects, and are publicly findable via the Cyber Essentials Delivery Partner IASME's website.

UK or Crown organisations with annual turnover under £20m that certify their entire organization can opt in to Cyber Liability Insurance included with Cyber Essentials, providing up to £25,000 of cover and 24-hour incident-response support. 

Most Assessors aim to return your results within three working days. There are three possible outcomes.

• Pass. You are certified for 12 months.

• Fail with a free resubmission. You get a report with the Assessor's comments on every non-compliant answer, then 2 working days to fix simple issues, update your answers, and resubmit at no extra charge.

• Fail outright. If you are still non-compliant after that window, you reapply and pay the assessment fee again.

One automatic fail to know about in advance: using unsupported software anywhere in scope will fail the assessment, regardless of how everything else scores. Otherwise you need to be compliant on nearly every question.

If the Assessor cannot mark a question because you haven't given enough detail, they'll return it asking for more — which adds a few days.

No. Cyber Essentials is not a legal requirement for UK businesses. It is a procurement requirement, which is a different thing.

Under the Cabinet Office Procurement Policy Note governing the scheme, central government departments, their executive agencies, non-departmental public bodies, and NHS bodies must require Cyber Essentials or Cyber Essentials Plus for contracts carrying higher cyber risk — typically those handling citizen or staff personal data, or systems processing data at OFFICIAL. Local authorities aren't formally in scope, though an increasing number apply it anyway. It's also required across the Ministry of Defence supply chain for suppliers handling defence information.

Buyers must accept demonstrated equivalent controls, so lacking the certificate doesn't automatically disqualify you — it just makes you prove it the slow way, at the point of bidding. And where certification is required, it must be renewed annually for the duration of the contract.

Commercially, many enterprise buyers in the UK now treat it as a baseline filter in vendor questionnaires.

Both look at the exact same five controls, but they differ significantly in how your compliance is verified. Note: you must pass the Cyber Essentials certification before you can attempt Cyber Essentials Plus. 

• Cyber Essentials is verified by self-assessment questionnaires signed off by a senior executive or equivalent. Cyber Essentials Plus is a hands-on, independent technical audit. 
• Cyber Essentials is a desktop review by an IASME-licensed Assessor, while Cyber Essentials Plus adds an independent technical audit, including vulnerability scanning and sample-based testing, to verify that the Cyber Essentials controls are implemented and operating effectively.   
  
  
  

Cyber Essentials is an annually renewable certification, so each certificate — Cyber Essentials and Cyber Essentials Plus alike — lasts 12 months. Lapse, and you're removed from IASME's public list of certified organisations.

Recertification is a genuine annual review: you re-enter all your answers each year, and the question set changes between versions.

The Cabinet Office explicitly notes that a Cyber Essentials certificate "provides assurance of compliance only at the time of testing" — organisations that stop patching or drift on secure configuration "may become non-compliant in substantially less than one year."

No platform can issue a Cyber Essentials certificate. Your assessment has to be marked by an Assessor — either through IASME directly on the self-led route, or through an IASME-licensed Certification Body on the supported route. And a board member or equivalent has to personally sign the declaration that your answers are true.

What Iru does is everything up to that point. The platform continuously collects evidence across your devices, identities, and cloud services, maps it to the five technical controls, and flags gaps while you can still fix them — rather than during your two working days to resubmit. For Cyber Essentials Plus, that same evidence is what your assessor samples against.

If you would like to work with one of the certification bodies we partner with, please book a demo to explore the compliance solution. Existing customers can reach out to their rep for info about our audit partners.

Almost certainly, yes.

The Cabinet Office states plainly that companies holding ISO 27001 "will not automatically conform to Cyber Essentials." The five technical controls usually aren't all inside an ISO 27001 scope, and generally aren't tested during an ISO 27001 audit. So most organisations need Cyber Essentials as well, or have to demonstrate equivalent controls, which is the slower route at the point of bidding.

It isn't much extra work. An ISO 27001 ISMS will already cover most of what the five controls ask for. What Cyber Essentials wants is those specific controls, evidenced in its own format, and attested by a board member.