Cyber Essentials & Cyber Essentials Plus Guide (v3.3, Danzell 2026)

Who it applies to

Any organisation can certify, of any size or sector. The NCSC says "a growing number of organisations require suppliers to be certified to bid for work" (NCSC). UK central-government contracts that handle certain personal or sensitive information commonly require it, and supply-chain programmes in defence, health and local government use it as a baseline. IASME is the NCSC's official Cyber Essentials Delivery Partner. It runs a network of more than 400 certification and advisory organisations.

The five technical controls

What changed in April 2026 (v3.3 and Danzell)

IASME's February 2026 notice summarises the changes (IASME):

• MFA auto-fail. MFA is mandatory for every cloud service that offers it, "whether it is free, included, or a paid option".
• Patching auto-fail. Questions A6.4 and A6.5 require high-risk and critical updates for operating systems, firmware and applications to be installed "within 14 days of release".
• Cloud services can't be excluded from scope, and there's now a formal definition of a cloud service.
• Scope transparency. You can give detailed scope descriptions, you must describe out-of-scope areas, and you must list every legal entity in scope. You can also request per-entity certificates for a small fee.
• "Point in time" means the date the certificate is issued. Systems must be supported on that date.
• The declaration now covers the whole year. The signatory acknowledges an ongoing responsibility to stay compliant.
• CE Plus integrity. If update testing fails, the retest includes a new random sample, and a second failure revokes the self-assessment certificate. You can't change your self-assessment answers after CE Plus testing starts.
• Guidance updates. "Web applications" is renamed "application development" and references the Software Security Code of Practice. Backups get more prominence, and passwordless methods such as passkeys are encouraged.

If your account was created before 27 April 2026, you have six months to certify under the previous requirements.

Certification process and timeline

Cyber Essentials (self-led route) (IASME):

1. Download the free question set and the Requirements for IT Infrastructure. You can also use the Readiness Tool.
2. Buy the assessment. You then have up to 6 months to complete it.
3. Answer the questions on the platform. A senior person signs the declaration.
4. An assessor reviews it within 3 working days. You can resubmit after clarifications.
5. Once you pass, the certificate is issued immediately and is valid for 12 months.

Cyber Essentials Plus (IASME Knowledge Hub):

• The audit must be finished within three months of your most recent Cyber Essentials certification.
• Under Danzell, you must fix any self-assessment non-conformities before you start CE Plus.
• The audit includes:
• external vulnerability scans of every public IP address
• tests on a representative sample of devices, covering each operating system
• checks that high and critical fixes were applied within 14 days
• checks that malware protection or allow-listing works
• checks that standard users can't do administrator tasks
• checks that MFA is used on all in-scope cloud services
• If non-compliances are found, you get 30 days to fix them. Every test must pass.

Costs

Official IASME prices for Cyber Essentials, excluding VAT (IASME):

Cyber Essentials Plus is quoted by Certification Bodies based on the size and complexity of your network. IASME also advertises free cyber insurance and a free 30-minute session with a Cyber Advisor for eligible SMEs.

Penalties

There are no statutory fines. The consequences are commercial: you may be unable to bid for contracts that require certification. Under the 2026 rules, a second CE Plus update-test failure revokes your verified self-assessment certificate.

Mapping to related frameworks

• ISO/IEC 27001 Annex A: the five controls map to technological controls such as malware protection, configuration, vulnerability management and access.
• ASD Essential Eight: a similar baseline in Australia, with overlapping patching, MFA and application-control strategies.
• NIST CSF 2.0: mainly the PROTECT outcomes (PR.AA, PR.PS, PR.IR).
• UK GDPR Article 32: Cyber Essentials is evidence of "appropriate technical measures".

Readiness checklist

1. Define scope: the whole organisation, or a segregated subset with justified exclusions. Include every cloud service.
2. List every legal entity in scope.
3. Inventory devices, operating systems, firmware and applications. Remove anything unsupported before the certificate date.
4. Turn on MFA for every cloud service that offers it, and record the ones that don't.
5. Set up a process to install high-risk and critical updates within 14 days.
6. Review firewall rules and default passwords, and switch off auto-run.
7. Remove admin rights from day-to-day user accounts.
8. Confirm malware protection or application allow-listing is in place.
9. Draft answers to the Danzell question set, then get board sign-off.
10. For CE Plus, book the audit early so it falls within three months, and fix every self-assessment gap first.

Common pitfalls

• Leaving SaaS tools out of scope. Cloud services can't be excluded.
• One unenforced MFA option is enough to fail automatically.
• Patching only the CE Plus sample. The retest now picks new devices.
• Unsupported operating systems still running on the certificate date.
• Treating certification as annual paperwork, when the declaration now covers the whole year.

How AssureCore helps

AssureCore lets you track the five controls in the Controls Register, store evidence such as MFA configurations and patch reports with expiry alerts for annual renewal, and map the work to ISO 27001 and NIST CSF through Cross-framework Mapping.

Frequently asked questions

Official references

• NCSC – Cyber Essentials overview
• IASME – Cyber Essentials (process and pricing)
• IASME – Changes to Cyber Essentials for April 2026
• IASME Knowledge Hub – How to certify to Cyber Essentials Plus
• NCSC – Requirements for IT Infrastructure v3.3 (PDF)

Related frameworks

• ISO 27001 guide
• SOC 2 guide
• NIST CSF guide
• NIST 800-171 guide