Cyber Essentials is a UK government backed scheme that checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. A VP of engineering mainly decides the certification level, the scope of devices and cloud services, and who answers the assessor.
What does the scheme cover?
The NCSC describes it as aligned to five controls meant to prevent the most common internet based attacks. Firewalls form a filter between the internet and your network. Secure configuration sets up computers to reduce ways in. Security update management stops attackers using known software flaws. User access control limits who can reach data and services and at what level. Malware protection detects and stops malicious software.
The NCSC also notes that a growing number of organisations require suppliers to be certified to bid for work, which is the usual reason engineering hears about it.
Which level should you choose?
There are two. The NCSC says Cyber Essentials combines a self-assessment with independent audit, and that Cyber Essentials Plus covers the same five controls but adds independent technical testing to verify that they work in practice. The self-assessed answers are signed off by a board member or equivalent and then marked by an assessor.
Choose by who is asking. If a customer's tender names Plus, there is no decision. If it names the basic level, start there, and consider Plus when you want stronger evidence for larger contracts.
What is the hard part for engineering teams?
Scope and consistency. Laptops, servers, cloud services, mobile devices used for work and home working arrangements all need to match what you said in the questionnaire. Update management is a typical trouble spot, because devices that rarely connect, old build servers and forgotten test machines drift out of date.
The scheme publishes free resources: a question set to preview and a requirements document for IT infrastructure. Read them before you start, because the questions are specific.
A constructed example
A 60 person company answers the access control questions and discovers that a shared administrator account on a build server is used by five engineers. Every answer on paper says individual accounts. The fix takes a day. The surprise was that nobody had a list of administrator accounts at all. Building that list became the first piece of evidence and the first real security improvement.
What to do
- Read the NCSC overview and download the free question set.
- Decide the target level with the customer or tender text in hand.
- Define scope: every device and cloud service used for company work, including personal devices if allowed.
- Inventory devices and administrator accounts, and close mismatches before answering.
- Check update settings and the age of operating systems and software on every in-scope device.
- Name one person to complete the questionnaire, and a board level signer.
- Choose between the self-led and the supported route, based on in-house experience.
- Calendar the annual renewal.
Safeguard can help you list the software dependencies behind your own services and spot known vulnerable components. The five controls above concern devices and networks, so they sit outside what a dependency scanner covers.
Quick check
What is the difference between Cyber Essentials and Plus?
Both assess the same five controls. Plus adds independent technical testing of your systems, according to the NCSC.
Who signs off a self-led assessment?
A board member or equivalent, and then an assessor marks the answers.
Sources
Last reviewed: 18 October 2026.
