Get Cyber Essentials certified, with real help.

What Cyber Essentials is, and how we help you pass it.

Cyber Essentials is the UK government-backed certification scheme, run by IASME on behalf of the National Cyber Security Centre (NCSC). It checks that an organisation has five basic technical controls in place — the controls that, according to the NCSC, would stop the large majority of common, opportunistic cyber attacks. It is deliberately not an exhaustive standard like ISO 27001; it is a focused baseline that any organisation can reach, and it has become the certificate that UK customers, funders and insurers recognise and ask for by name.

The five controls, in plain English

• Firewalls. Every device that connects to the internet sits behind a properly configured firewall, and the firewall itself isn't left on its default password. This is your front door.
• Secure configuration. Devices and software are set up to be secure rather than convenient out of the box — remove default accounts and unused software, and never ship with "admin/admin" still working.
• User access control. People get only the access they need, everyday accounts aren't administrators, leavers are removed promptly, and multi-factor authentication protects the accounts that matter — especially email and cloud services.
• Malware protection. Every device is protected against malware, whether through built-in tools like Microsoft Defender, a paid product, or allow-listing what software is permitted to run.
• Security update management. Software is kept supported and up to date, with high-risk and critical patches applied within 14 days. Anything the vendor no longer supports is removed.

Self-assessment vs Cyber Essentials Plus

There are two levels. Cyber Essentials (the base level) is a verified self-assessment: you answer a structured questionnaire about your systems and an accredited certification body reviews and marks it. It is honesty-based, which is why getting the answers genuinely right — rather than guessing — matters. Cyber Essentials Plus covers the same five controls but adds a hands-on technical audit by an assessor, who tests a sample of your devices and your internet-facing systems to confirm the controls are actually working. Plus is often what a larger customer or a public-sector contract specifically requires; the usual route is to pass the self-assessment first and then book the Plus audit, which must follow within three months.

Who it's for

Cyber Essentials suits any UK organisation, but it is most urgent when someone is asking you for it: a larger customer flowing the requirement down their supply chain, a grant funder doing due diligence, an insurer pricing cyber cover, or a public-sector tender that mandates it. The controls are universal, but what they protect against is not — the fraud that hits a small charity is not the ransomware that stops a factory line. That is why we treat the certificate the same everywhere and the risk differently by sector: see our tailored pages for manufacturing, e-commerce, charities, law firms, accountants and more.

How Solvbeat prepares you

• Baseline scan. We run an external scan against your domain and internet-facing infrastructure to see what an attacker would see, then use an internal agent to check devices, patch levels and configuration against the five controls.
• Gap review. A real conversation, not a report thrown over the wall — we walk your team through what applies to your setup and what needs to change.
• Remediation support. We help you actually fix the findings: firewall configuration, MFA rollout, access tidy-up, patching and removing unsupported software.
• Submission. We help you complete the self-assessment accurately, or coordinate the audit for Cyber Essentials Plus, and the certificate is issued by the accredited body.

How it relates to ISO 27001 and other standards

Cyber Essentials is often the first rung on a longer ladder. ISO 27001 is a full information-security management system — far broader, involving risk assessment, policies, ongoing governance and an external audit — and is usually pursued by larger organisations or those whose customers demand it. Cyber Essentials, by contrast, can be reached in weeks and gives you the concrete technical baseline that ISO 27001 also expects. Many organisations start with Cyber Essentials to answer immediate customer and funder requirements, then build towards ISO 27001 later if their contracts call for it. The two are complementary, not competing, and the work you do to pass Cyber Essentials is never wasted.

Cost and timeline

Certification is issued through an accredited certification body and the fee is banded by organisation size. Cyber Essentials self-assessment starts from around £300 plus VAT for the smallest organisations and rises in bands with headcount; Cyber Essentials Plus adds the technical audit and costs more on top. Preparation and certification typically take one to three weeks — the limiting factor is how fast you can close gaps such as enabling MFA or replacing unsupported software, not the paperwork. The certificate is valid for twelve months, after which you recertify.

The fastest way to find out where you stand is a free baseline scan — it gives you an honest read on how far you are from certification before you commit to anything.