UK Cyber Essentials and Cyber Essentials Plus

Why does it matter?

Cyber Essentials gives a buyer, an insurer or a regulator a plain statement that the controls behind most commodity attacks are in place and have been checked by someone independent. For a supplier it is often the entry ticket: PPN 014 lets central government and NHS buyers require certification on contracts that touch personal information or OFFICIAL data, and requires certification to be renewed annually for the length of the contract. The scheme does not assure a product or service and is not designed to stop advanced, targeted attacks, which PPN 014 says need additional measures.

Key benefits include:

• A defined scope

Section D requires a scope boundary covering the business unit, the network boundary and the physical location, agreed with the Certification Body before assessment begins.

• Five checkable controls

Section E states each control as requirements an assessor can mark, from firewall rules to the 14-day update window.

• Independent verification

Answers are signed off by a board member or equivalent and marked by an assessor; Cyber Essentials Plus adds technical testing.

• Cloud accountability

The applicant is always responsible for the controls on its cloud services, even where the provider implements them.

• Procurement recognition

PPN 014 names either certification, or equivalent controls, for in-scope government contracts.

How does it work?

The applicant starts with scope. The requirements apply to every in-scope device and software that can accept incoming connections from internet-connected devices, can establish outbound connections to devices via the internet, or controls the flow of data between those devices and the internet. A scope without end-user devices is not acceptable, cloud services holding organizational data or running organizational services must be in scope, and a partial scope needs a justification the assessor will test.

The applicant then works through five control themes, each with an aim, an introduction and requirements. It answers the question set in the assessment account, the answers are signed off at board level and marked by an assessor, and certification is awarded if the requirements are met. The NCSC describes two routes: self-led, registering and paying through IASME, or supported, hiring a Certification Body licensed by IASME to explain the questions.

Cyber Essentials Plus tests the same five controls. Under PPN 014 it comprises remote and on-site vulnerability testing, using widely available commodity tools, to show that the controls actually defend against basic hacking and phishing attacks. PPN 014 says certification must be renewed annually where it is required for the length of a contract.

Key Elements

• Firewalls (section E.1)

Change default administrator passwords or disable remote administration; block unauthenticated inbound connections by default; document and approve each inbound rule with its business need; use a software firewall on devices used on untrusted networks.

• Secure Configuration (E.2)

Remove unnecessary accounts and software, change default and guessable passwords, disable auto-run, and protect device sign-in credentials against brute force with no more than 10 guesses in 5 minutes or a lock after no more than 10 attempts.

• Security Update Management (E.3)

Software must be licensed and supported; critical or high-risk fixes, meaning a CVSS v3 base score of 7 or above, must be applied within 14 days of release.

• User Access Control (E.4)

Approved accounts with unique credentials, separate administrator accounts, removal of unneeded privileges, and multi-factor authentication wherever available; cloud services must always use it.

• Malware Protection (E.5)

Either anti-malware that updates, blocks malware, blocks malicious code and blocks malicious websites, or application allow listing restricted by code signing.

• Cloud services (D.iv)

Infrastructure as a Service, Platform as a Service and Software as a Service are treated separately; where the provider implements a control, a contract or a document referenced by contract must commit it.

What does it cover?

Section D sets the boundary. The scheme covers the IT infrastructure used to carry out the organization's business, or a well-defined, separately managed sub-set segregated by a firewall or VLAN. Employees', volunteers' and trustees' own devices that reach organizational data are in scope, as are devices owned by the organization and loaned to third parties; devices used only for native voice, text or authenticator apps are out of scope. A home router supplied by the organization is in scope, an ISP router is not, and wireless devices are in scope if they can communicate via the internet. Accounts the organization owns stay in scope even when a managed service provider uses them.

What are its objectives?

The scheme exists to give organizations a clear statement of the fundamental controls and a way to prove they are in place.

Mitigate the risks from many common internet-based threats by implementing five technical controls, within the government's 10 Steps to Cyber Security.

Let an organization demonstrate to customers, investors, insurers and others that it has taken those precautions.

Make firewalls, configuration, updates, accounts and malware defenses answerable to an assessor's checks.

Add technical testing at the Plus level, showing the controls work against basic attacks.

Support proportionate supply-chain assurance under PPN 014 without imposing certification on every contract.

Framework in Context

Cyber Essentials is the entry level of UK assurance. The NCSC places it within the 10 Steps to Cyber Security, and the requirements document says that implementing the controls does not prevent a zero trust architecture as the NCSC defines it. The requirements treat backing up data as recommended but not a technical requirement. The NCSC states that organizations with turnover under 20 million pounds that certify their whole organization are automatically entitled to cyber liability insurance arranged by IASME. For wider programs, organizations pair it with ISO/IEC 27001 or the NIST Cybersecurity Framework.

Common Framework Mappings

Organizations map the five controls to the frameworks below so that one set of control tests and evidence supports the scheme, a procurement response and a wider security program.

Mapped frameworks include:

CIS Controls v8.1

IASME Governance Standard

ISO 27001:2022

ISO 27002:2022

NCSC 10 Steps to Cyber Security

NIST CSF 2.0

NIST 800-53 Rev.5