Cyber Essentials requirements: the five controls explained

Cyber Essentials is a UK government-backed certification scheme, delivered by IASME, that sets out five technical controls (opens in new tab) every organisation should have in place to defend against the most common internet-based attacks. Meeting all five is what the scheme requires. As a Cyber Essentials certification body, we assess businesses against these controls, so here is what each one asks of you.

1. Firewalls

Protect the boundary of your network with firewalls. Every device that connects to the internet needs to sit behind a firewall, whether that is a dedicated boundary firewall on your network or the software firewall built into a laptop used away from the office. The requirement is that the firewall is switched on, its default administrative password has been changed, and it only allows the network services you need. Anything that is not required is blocked.

2. Secure configuration

Remove or disable unnecessary functionality, and change default passwords, so devices and software are not left in a weak default state. Computers, servers, phones and network devices ship with settings chosen for convenience rather than security. The requirement is to tighten them: delete or disable accounts and software you do not use, change or remove any default passwords, and turn off features you do not need. A device set up this way gives an attacker far less to work with.

3. User access control

Give people unique accounts with the least privilege they need to do their job, keep administrative rights tightly controlled, and enforce multi-factor authentication. Everyday work should happen in a standard user account, not an administrator one, and admin access should be granted only where it is needed and used only for admin tasks. Accounts should belong to real, named individuals, and multi-factor authentication adds a second check so a stolen password alone is not enough to get in.

4. Malware protection

Protect every in-scope device against malicious software. The requirement can be met in more than one way: run anti-malware software that is kept up to date, or restrict what can run on a device to an allow-list of approved applications. Either approach stops known malware and untrusted software from executing. The point is that no device in scope is left with nothing standing between it and a malicious file or link.

5. Security update management

Use software that is still supported by its vendor, and apply security updates promptly. Unsupported software stops receiving fixes and cannot be made safe, so it has to be updated, replaced or removed from the devices in scope. For software that is supported, security updates must be applied quickly: high-risk or critical updates are expected within 14 days of release, across operating systems, firmware and applications.

Those five controls are the whole of the standard, and none of them is exotic. Most businesses already do some of it and simply need to close the gaps. If you would rather have help meeting the controls, that is the sort of work our NCSC Assured Service Provider team does, and for a sense of the outlay, see our guide to what Cyber Essentials costs.

What changed in April 2026

In April 2026 two of the five controls became stricter and now cause an automatic fail. Multi-factor authentication is required on all cloud services where it is available, and high-risk or critical security updates must be installed within 14 days. The current question set, and the date it applies from, are published by IASME (opens in new tab). If either is not already in place, it is the first thing to sort out, because you cannot certify without it.

Cyber Essentials Plus requirements

The requirements for Cyber Essentials Plus, often written CE+, are exactly the same five controls. There is no additional control set to implement and no longer list to work through. Anyone telling you CE+ has extra requirements has misread the scheme.

What changes is how the controls are verified. Basic Cyber Essentials is a self-assessment that an appointed certification body reviews and verifies. Cyber Essentials Plus adds a technical audit, where an assessor tests a sample of your devices and accounts to confirm the controls work in practice rather than on paper.

So the practical difference is evidence, not scope. A control you have described accurately will pass both. A control that is configured on most devices but not all will pass the self-assessment and fail the audit. That gap is where nearly every CE+ failure lives, and our guide to preparing for Cyber Essentials Plus walks through what the assessor checks.

One prerequisite that catches people: you must hold a current basic Cyber Essentials certificate before applying for Cyber Essentials Plus, and it has to be recent. Certify the two together rather than months apart.

Do the requirements change for defence or MOD work?

The five controls do not change, but what you have to hold alongside them does. Every level of Defence Cyber Certification requires Cyber Essentials, and DCC Levels 2 and 3 require Cyber Essentials Plus as well. The MOD has asked all industry partners to achieve DCC Level 0 by 31 December 2026, and that request explicitly includes obtaining Cyber Essentials for all applicable business-critical systems in scope.

The requirement most often missed there is scope rather than controls: Cyber Essentials scope is set by you, contract scope is set by the contract, and the two are decided separately. DCC and Cyber Essentials covers how the two schemes fit together.

Getting certified against these requirements

We are an appointed Cyber Essentials certification body, so the assessment against these controls happens here rather than being passed to a third party. If you want to know where you stand before committing, the Cyber Essentials readiness checker is a five minute self check against the five controls, and Cyber Essentials certification sets out how the process runs.