Cyber Essentials (2025)
NCSC-backed UK scheme (delivered by IASME) covering 5 mandatory technical control themes, self-assessed via a marked questionnaire with board-level sign-off. Cyber Essentials Plus adds independent technical testing on top of the same 5 themes and is represented here as the two optional requirements below — adopt both together, since Plus is assessed as a single pass/fail outcome by an independent tester, not requirement-by-requirement; adopting only one does not correspond to any real certification state. Bodies in this catalog are plain-language summaries authored for this product, not verbatim text from NCSC's published 'Cyber Essentials: Requirements for IT Infrastructure v3.2, April 2025'. Customers needing the authoritative requirement text should reference that document directly via ncsc.gov.uk.
Requirement bodies below are plain-language summaries authored by Compliance. For the verbatim text of the standard, reference the publication from your national standards body (NEN, BSI, ANSI, ...).
Firewalls (1)
Boundary firewalls and internet gateways are in place on all internet-connected devices and networks, with default administrative passwords changed, unnecessary or risky services and rules removed, and inbound connections blocked unless specifically approved. Devices routinely used outside the office (laptops, mobile devices) run an equivalent host-based firewall or filtering.
Secure configuration (1)
Devices and software are configured to reduce vulnerabilities and expose only the functionality actually needed: unnecessary user accounts and software are removed or disabled, default and guessable passwords are changed, auto-run features are disabled, and devices lock automatically and require authentication to resume.
Security update management (1)
All operating systems and software in scope are licensed, supported, and kept up to date, with unsupported software removed. High and critical security updates are applied within 14 days of release, and automatic updates are enabled wherever available.
User access control (1)
Accounts are provisioned only for authorised individuals via a defined process, with administrative privileges granted only to those who need them and used only for administrative tasks. Access requires authentication (multi-factor for cloud services and administrative access), and accounts are removed or disabled promptly when no longer needed.
Malware protection (1)
Devices are protected from malware, either by anti-malware software kept up to date with the latest signatures and configured to scan files on access and web pages on access, or by restricting devices to an approved list of applications (application allow-listing).
Cyber Essentials Plus (2)
An independent, NCSC-approved certification body performs an external vulnerability test against the organisation's internet-facing systems, verifying from outside the network that the self-assessed controls (particularly Firewalls and Security update management) actually hold up under technical scrutiny. Adopt together with CEP-2 — see this Framework's description.
The certification body performs an authenticated, on-network test against a representative sample of the organisation's workstations and servers, verifying controls (particularly Secure configuration, User access control, and Malware protection) from the perspective of a logged-in user or device already inside the network. Adopt together with CEP-1 — see this Framework's description.