What is Cyber Essentials?
Cyber Essentials is the UK government-backed minimum standard for cyber security, run by the National Cyber Security Centre (NCSC) and delivered by IASME. It's built around five technical controls that catch the most common ways organisations get compromised.
Certification requires passing a self-assessment questionnaire (or, for Cyber Essentials Plus, a hands-on technical audit). Many public sector contracts and a growing number of private sector ones require it as a minimum bar for suppliers — not having it can be the equivalent of leaving the front door unlocked, from an assessor's point of view.
Note
The current version is Cyber Essentials v3.3 ("Danzell"), in force since 27 April 2026.
The five controls
| Control | What it covers | |---|---| | Firewalls | Every device has a properly configured firewall, with remote administration locked down | | Secure Configuration | Default credentials changed, unnecessary autorun/features disabled, devices built to a hardening baseline | | User Access Control | Admin accounts kept to a minimum, and MFA enforced on any cloud service that supports it | | Malware Protection | Anti-malware software installed, scanning in real time, updating its definitions automatically | | Patch Management | Operating systems and applications kept up to date, with critical patches applied promptly |
Warning
Under v3.3, two things are an automatic fail regardless of your score elsewhere: missing MFA on an admin account for a cloud service that supports it, and missing a critical OS, firmware, or application patch within 14 days of release.
How ClearAsset helps
ClearAsset's Cyber Essentials add-on tracks all five controls against your existing asset register — devices, software, and user accounts — and shows you where the gaps are before you sit the actual assessment. See Does ClearAsset replace a CE assessment? for how far that goes.