Automate Cyber Essentials readiness with adaptive compliance

Cyber Essentials is a UK government-backed, industry-supported scheme overseen by the National Cyber Security Centre (NCSC)

Cyber Essentials evaluates five technical controls designed to prevent the most common internet-based cyber threats: firewalls, secure configuration, security update management, user access control, and malware protection

Cyber Essentials is a verified self-assessment. You choose one of two routes: self-led, where you complete the assessment yourself, or supported, where you pay for support from a Cyber Advisor or Certification Body.  Either way, your answers must be signed off by a board member or equivalent, then marked by an assessor.

Cyber Advisors are cyber security professionals who've passed an independent assessment covering their knowledge of the five  technical controls, their competence at hands-on support, and their ability to work with smaller organisations to implement these controls. They are not involved with certification. 

Cyber Essentials Plus builds on the same five technical controls, but adds independent technical testing to verify the controls are actually in place. The Cyber Essentials Plus audit must be completed within three months of the Cyber Essentials certification, or you will be forced to re-do the self-assessment. 

Testing covers a representative sample of end user devices, your internally hosted servers, and your cloud services — IaaS, PaaS, and SaaS alike. Assessors run an external vulnerability scan, an authenticated patch scan, malware protection tests, multi-factor authentication checks on every cloud service, and account separation checks.

The output of a Cyber Essentials engagement is a Cyber Essentials certificate, which names the scope it covers — whole organisation or a defined sub-set. These are typically shared with customers and prospects, and are publicly findable via the Cyber Essentials Delivery Partner IASME's website.

UK organisations with turnover under £20m that certify their whole organisation also receive free Cyber Liability Insurance arranged by IAS.

UK or Crown organizations with annual turnover under £20m that certify their entire organization can opt in to Cyber Liability Insurance included with Cyber Essentials, providing up to £25,000 of cover and 24-hour incident-response support. 

Most Assessors aim to return your results within three working days. There are three possible outcomes.

• Pass. You are certified for 12 months.

• Fail with a free resubmission. You get a report with the Assessor's comments on every non-compliant answer, then 2 working days to fix simple issues, update your answers, and resubmit at no extra charge.

• Fail outright. If you are still non-compliant after that window, you reapply and pay the assessment fee again.

One automatic fail to know about in advance: using unsupported software anywhere in scope will fail the assessment, regardless of how everything else scores. Otherwise you need to be compliant on nearly every question.

If the Assessor cannot mark a question because you haven't given enough detail, they'll return it asking for more — which adds a few days.

No. Cyber Essentials is not a legal requirement for UK businesses. It is a procurement requirement, which is a different thing.

Under the Cabinet Office Procurement Policy Note governing the scheme, central government departments, their executive agencies, non-departmental public bodies, and NHS bodies must require Cyber Essentials or Cyber Essentials Plus for contracts carrying higher cyber risk — typically those handling citizen or staff personal data, or systems processing data at OFFICIAL. Local authorities aren't formally in scope, though an increasing number apply it anyway. It's also required across the Ministry of Defence supply chain for suppliers handling defence information.

Buyers can accept equivalent controls demonstrated by an independent third party, at their discretion, so lacking the certificate doesn't automatically disqualify you — it just makes you prove it the slow way, at the point of bidding. And where certification is required, it must be renewed annually for the duration of the contract.

Commercially, many enterprise buyers in the UK now treat it as a baseline filter in vendor questionnaires.

Both look at the exact same five controls, but they differ significantly in how your compliance is verified. Note: you must pass the Standard certification before you can attempt Cyber Essentials Plus. 

• Cyber Essentials is verified by self-assessment questionnaires signed off by a senior executive. Cyber Essentials Plus is a hands-on, independent technical audit. 
• Cyber Essentials is a desktop review by an accredited Assessor, while Cyber Essentials Plus adds an independent technical audit, including vulnerability scanning and sample-based testing, to verify that the Cyber Essentials controls are implemented and operating effectively.   
  
  
  

Cyber Essentials is an annually renewable certification, so each certificate — Cyber Essentials and Cyber Essentials Plus alike — lasts 12 months. Lapse, and you're removed from IASME's public list of certified organisations.

Recertification is a genuine annual review: you re-enter all your answers each year, and the question set changes between versions.

The Cabinet Office explicitly notes that a Cyber Essentials certificate "provides assurance of compliance only at the time of testing" — organisations that stop patching or drift on secure configuration "may become non-compliant in substantially less than one year."

No platform can issue a Cyber Essentials certificate. Your assessment has to be marked by an Assessor — either through IASME directly on the self-led route, or through an IASME-licensed Certification Body on the supported route. And a board member or equivalent has to personally sign the declaration that your answers are true.

What Iru does is everything up to that point. The platform continuously collects evidence across your devices, identities, and cloud services, maps it to the five technical controls, and flags gaps while you can still fix them — rather than during your two working days to resubmit. For Cyber Essentials Plus, that same evidence is what your assessor samples against.

If you'd like to work with one of the Certification Bodies we partner with, please reach out to your rep.