Cyber Essentials has quietly become one of the most useful things a small UK business can do for its security, and one of the most misunderstood. It is not a badge you buy. It is a set of five basic controls that stop the majority of routine, automated attacks, checked once a year. If your customers, your insurer, or a public-sector contract are starting to ask whether you hold it, this guide explains what the scheme covers in 2026, what changed this year, and what it realistically takes for a firm of 10 to 50 people to pass.
What Cyber Essentials and Cyber Essentials Plus actually are
Cyber Essentials is a UK government-backed certification, run by the NCSC and delivered through IASME. It covers five technical control areas. You complete a verified self-assessment questionnaire, a board member or director signs a declaration that your answers are true, and an assessor marks it. Certificates last twelve months and are renewed annually.
Cyber Essentials Plus covers the exact same five controls, but adds an independent technical audit. An assessor runs internal and external vulnerability scans and tests a random sample of your devices, gateways and internet-facing servers (typically around 10 per cent) rather than taking your word for it. Same controls, higher assurance. It is the version insurers and larger customers increasingly ask for by name.
What changed for 2026
The five core controls have not changed. What has changed is how strictly they are marked, and the scheme has become notably less forgiving of the basics being skipped. The headline updates, which apply to assessment accounts created after 26 April 2026, are worth knowing before you apply:
-
Multi-factor authentication is now an auto-fail. If MFA is available on a cloud service and you have not turned it on, the whole assessment fails, regardless of how well you score elsewhere.
-
Two security-update questions are now auto-fail. High-risk or critical updates for operating systems, router and firewall firmware, and applications must be installed within 14 days of release. Miss this and you fail.
-
Cloud services cannot be excluded from scope. IASME has added a clear definition of a cloud service, and if it stores or processes your data, it is in scope.
-
Scope definitions are tighter. You now describe in-scope and out-of-scope areas in detail, name the legal entities covered, and justify any exclusions.
-
Passwordless authentication, such as passkeys, is formally recognised as a stronger alternative to passwords.
The current question set through early 2026 is Willow. Its replacement, Danzell, was published on 13 February 2026 and applies to accounts created after 26 April 2026. If you have an active account created before that date, you have six months to certify under the previous version.
The five controls in plain English
1. Firewalls
Every device that connects to the internet sits behind a properly configured firewall or equivalent. Default admin passwords on that kit are changed, and you are not exposing management interfaces to the whole internet without good reason.
2. Secure configuration
Devices and software are set up deliberately, not left on out-of-the-box defaults. Unnecessary accounts and software are removed, and default passwords are changed everywhere.
3. Security update management
Everything in scope is supported and patched. Critical and high-risk updates go on within 14 days. Unsupported software, an operating system past its end of life for example, is an automatic fail.
4. User access control
People get only the access they need. Administrator rights are limited and separated from everyday accounts, accounts are removed when people leave, and MFA protects access to cloud services and remote logins.
5. Malware protection
Devices are protected against malware, whether through anti-malware software, application allow-listing, or the built-in controls on a well-configured platform.
Where firms actually fail
On paper the controls sound straightforward. In practice, most first-time failures come from a short list of predictable issues:
-
MFA gaps. MFA is on for most people but not everyone, or it is missing on one cloud service nobody thought counted. Since April 2026 that is now an outright fail, not a deduction.
-
Unsupported operating systems. An old Windows machine, an unpatched server, or a phone past its update window quietly sitting in scope. Unsupported software fails the assessment on its own.
-
Cloud services left out of scope. Firms assume software-as-a-service is the vendor’s problem. It is not. If it holds your data, it is in scope and must be secured.
-
Personal devices (BYOD). Staff using their own laptops and phones to access company email or data pulls those devices into scope. Deciding your BYOD position early avoids a scramble later.
-
Patching that is not routine. Updates happen eventually, but not within 14 days and not consistently. The new auto-fail rules make an actual patching routine non-negotiable.
Realistic effort and cost for a 10 to 50 person firm
The assessment fee itself is modest and tiered by size. IASME lists Cyber Essentials at £320 + VAT for micro organisations (0 to 9 staff), £440 + VAT for small (10 to 49), £500 + VAT for medium (50 to 249) and £600 + VAT for large (250+). Certification also bundles cyber liability insurance for UK organisations with turnover under £20 million. Cyber Essentials Plus is quoted individually and depends on the size and complexity of your network.
The fee is rarely the real cost. The effort is in the preparation: confirming MFA is on everywhere, retiring or replacing anything unsupported, tightening admin rights, and getting patching onto a routine. If your basics are already in reasonable shape, a small firm can often complete the self-assessment in a matter of hours once answers are prepared. If they are not, budget a few weeks of tidying-up first. Assessors typically return results within three working days, and you get two working days to fix simple issues and resubmit.
Certification is a floor, not a finish line
Passing Cyber Essentials proves you have the basics in place on the day you certify. That is genuinely valuable, and adoption is rising: the 2025/2026 Cyber Security Breaches Survey found the proportion of businesses holding Cyber Essentials up to 5 per cent overall, with small businesses more than doubling from 5 to 12 per cent. But a once-a-year snapshot does not tell you whether your controls held up the other 364 days, whether your backups actually restore, or whether you would know what to do in the first hour of an incident.
On the TrustOps Maturity Model, Cyber Essentials sits at Level 2 — Foundations: the controls are in place, but security is not yet measured, tested or continuously assured. Levels 3 to 5 are where a business moves from “certified once a year” to “posture we can see and improve”. The point of certifying is not the certificate. It is knowing where you stand and having a sensible next move.
A sensible next step
If you are not sure whether you would pass today, the honest first move is to find out where you actually stand. Our free 15-minute assessment scores you out of 100 against the same control areas Cyber Essentials tests, shows your top five gaps, and tells you whether certification is a quick tidy-up or a bigger piece of work — whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
Sources
IASME — Important Update: Changes to Cyber Essentials for April 2026 (MFA and security-update auto-fails, cloud scope, Danzell question set): https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
IASME — Cyber Essentials Frequently Asked Questions (pricing tiers, CE vs CE Plus, unsupported software auto-fail, timelines): https://iasme.co.uk/cyber-essentials/frequently-asked-questions/
NCSC — Cyber Essentials overview and Requirements for IT Infrastructure resources: https://www.ncsc.gov.uk/cyberessentials/overview
DSIT — Cyber Security Breaches Survey 2025/2026 (Cyber Essentials adoption figures): https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
