Cyber Essentials

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-04-27 Cyber Essentials Requirements for IT Infrastructure v3.3 take effect for new applications
2. 2025-04-28 Requirements for IT Infrastructure v3.2 take effect
3. 2025-02-24 Procurement Policy Note 014 applies to central government and NHS procurements under the Procurement Act 2023

1. 2026-04-27
   Requirements for IT Infrastructure v3.3 RevisionCurrent

   Cloud services can no longer be excluded from scope, and the requirements add a cloud services definition, FIDO2 in passwordless authentication and the Software Security Code of Practice. source

   More

   • Scope criteria no longer refer to "untrusted connections".
   • The importance of backing up data is emphasised.
   • Applications started before 27 April 2026 can continue to follow v3.2.
   • The self-assessment question set for purchases from 27 April 2026 is called "Danzell" (IASME, the Cyber Essentials Delivery Partner).
2. 2025-04-28
   Requirements for IT Infrastructure v3.2 Revision

   Added passwordless guidance to user access control and extended security update management to vulnerabilities fixed only by manual configuration. source

   More

   • Software definition updated and a vulnerability fix definition added.
   • References to "home working" changed to "home and remote working".

Any organisation can certify. Central government and NHS buyers require Cyber Essentials or equivalent controls for contracts that handle sensitive or personal information.

Five controls

Firewalls, secure configuration, security update management, user access control and malware protection. source

Scope

A scope that excludes end-user devices is not acceptable, and cloud services hosting the organisation's data or services must be in scope. source

Public contracts

Central government departments, their agencies and NHS bodies must require suppliers to meet the technical requirements for contracts that, for example, handle citizens' or government employees' personal information. source

Equivalent controls

A supplier without Cyber Essentials or Cyber Essentials Plus must be able to show equivalent controls by other means. source

Cyber Essentials is a verified self-assessment marked by an assessor; Cyber Essentials Plus adds independent technical testing. Government contracts require annual renewal.

Cyber Essentials

A verified self-assessment signed off by a board member or equivalent and marked by an assessor; pricing starts at £320 plus VAT. source

Cyber Essentials Plus

The same five controls, plus independent testing of systems to verify the controls work in practice. source

Renewal

Where a contract requires Cyber Essentials, the supplier must renew it annually for the duration of the contract. source

Patching

Updates fixing critical or high-risk vulnerabilities, or CVSS v3 scores of 7 or above, must be applied within 14 days of release. source

Check a certificate

All current certificates can be searched on the IASME website. source

Enforced through procurement and contracts rather than fines: in-scope public buyers must require it, and suppliers renew it annually for the contract term.

Procurement

Since 2014 the government has required suppliers bidding for certain public contracts to hold Cyber Essentials or Cyber Essentials Plus, or show equivalent controls. source

Timing of evidence

Evidence of a certificate or equivalent is essential at the point when data is to be passed to the supplier. source

1. Standard Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026)
2. Standard Cyber Essentials: Requirements for IT Infrastructure v3.2 (April 2025)
3. Guidance Cyber Essentials resources (NCSC)
4. Guidance Cyber Essentials overview (NCSC)
5. Guidance PPN 014: Cyber Essentials scheme (Cabinet Office)

1. NCSC

   The NCSC's wider guidance, including the Cyber Assessment Framework for essential services; Cyber Essentials is its baseline certification for any organisation.

2. ISO 27001

   A certifiable management system standard covering risk-based information security as a whole, rather than five fixed technical controls.

3. Essential Eight

   Australia's baseline mitigation strategies, assessed against maturity levels rather than certified pass or fail.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Cyber Essentials (RSS)