Cyber Essentials (United Kingdom)

Cyber Essentials is the UK certification, backed by government and run under the National Cyber Security Centre (NCSC), that attests an organization applies five basic technical controls. The scheme launched in June 2014. Since October 1, 2014, central government has required it from suppliers on certain contracts that handle personal data or sensitive information. The five controls are firewalls, secure configuration, user access control, malware protection and security update management. Since 2020 a single delivery partner, IASME, has run the scheme and accredited the certification bodies. There are two tiers, and for an underwriter all the value sits in the gap between them. The basic tier rests on a self-assessment questionnaire, signed off by a director and reviewed by a certification body. Cyber Essentials Plus keeps the same requirements and adds technical verification: the assessor scans, tests a sample of devices and accounts, and tries out booby-trapped attachments. The certificate is valid for a year. The content moves faster than the name: the requirements are revised regularly, and multi-factor authentication (MFA) on cloud services has become mandatory. IASME has bundled a small free cyber liability policy with the basic certificate for small organizations that certify their whole scope, subject to a turnover cap. On the market side, most UK questionnaires ask whether the company is certified, and at which tier. A "yes, Plus" answers part of the patching and account questions, which the underwriter then does not ask again. The caveat: the certificate is a snapshot of a declared scope on a given date. A subsidiary left out of scope or a server spun up the following month is not in it, and nothing in it deals with backups or incident response.