Cyber Essentials accreditation is the UK government-backed (NCSC) certification that proves your business has the 5 essential security controls in place — firewalls, secure configuration, access control, malware protection, and patching. IASME fee from £320 + VAT. Most businesses certify in 2–4 weeks. The Danzell SAQ (April 2026) introduced stricter MFA and cloud scoping requirements — Coreitech guides you through the current version end-to-end.
CYBER ESSENTIALS
CERTIFICATION
UK — NCSC SCHEME
Coreitech provides end-to-end Cyber Essentials accreditation support for London and UK businesses — from gap assessment and remediation through to IASME certification. Most clients achieve accreditation within 2–4 weeks.
What Cyber Essentials accreditation
actually requires
Cyber Essentials covers five technical controls. To achieve accreditation, your business must demonstrate compliance with all five. Here's exactly what each one requires — and how Coreitech helps you meet them.
Firewalls
Boundary firewalls must be configured to block inbound connections not explicitly permitted. All devices (including laptops used remotely) must have a software firewall. Default passwords must be changed.
Secure Configuration
All devices and software must be configured securely — unnecessary software removed, auto-run features disabled, default credentials changed, and devices locked after a period of inactivity.
User Access Control
User accounts must only have the access they need (principle of least privilege). Standard user accounts must not have administrative privileges for everyday tasks. Admin accounts must be separate.
Malware Protection
All devices must have anti-malware software with up-to-date definitions, configured to scan in real time. Alternatively, application allowlisting or sandboxing may be used.
Patch Management
All software and operating systems must be licensed and supported, with the latest security patches applied within 14 days of release. Unsupported (end-of-life) software must be removed or isolated.
Coreitech handles the remediation for you — configuring firewalls, patching, MFA, access controls, and endpoint security before your assessment.
Cyber Essentials Danzell SAQ — what changed in April 2026
The Cyber Essentials Self Assessment Questionnaire (SAQ) was updated to the Danzell version in April 2026, introducing stricter requirements around cloud services, MFA, patch management, and scoping. Key changes include: tighter controls on cloud service authentication (MFA now required on all cloud accounts, not just admin accounts), clearer scoping for SaaS platforms, stricter patch management timelines for internet-facing services (14 days), and stronger requirements for user access control in hybrid cloud environments.
Businesses that previously held CE certification and are renewing under Danzell may need to make additional changes — particularly around Microsoft 365 MFA enforcement and cloud service scoping. Coreitech guides all clients through the current Danzell question set.
Cyber Essentials vs
Cyber Essentials Plus
| Factor | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Assessment type | Self-assessment questionnaire reviewed by certifier | Independent technical audit by IASME assessor |
| Physical testing | No — self-declared controls | Yes — assessor verifies controls are working |
| IASME certification fee | ~£320–500 + VAT | ~£500–800 + VAT (size-dependent) |
| £25,000 cyber insurance | Included (if eligibility met) | Included (if eligibility met) |
| Timeline | 2–4 weeks | 4–8 weeks |
| Required for | Most government contracts, NHS, many supply chains | MOD, higher-classified government, some NHS frameworks |
| Renewal | Annual questionnaire | Annual independent re-test |
| Recommended for | All SMEs as baseline | After achieving basic CE, when supply chain demands it |
How much does Cyber Essentials accreditation cost?
The IASME certification fee (paid to the certifying body) is based on organisation size — typically £300–£500 + VAT for small businesses. This is fixed by IASME.
Coreitech charges separately for preparation support (gap assessment, remediation, questionnaire guidance). Most small businesses need 4–12 hours of preparation depending on their current IT posture. We provide a fixed-price quote after a free readiness review.
Why get Cyber Essentials accredited?
How long does accreditation take?
What is Cyber Essentials
accreditation?
Cyber Essentials accreditation is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It certifies that your business has the essential technical controls in place to protect against the most common cyber threats — phishing, malware, hacking, and password attacks.
The scheme focuses on five security controls: firewalls, secure configuration, user access control, malware protection, and patch management. Achieving accreditation demonstrates to clients, insurers, and partners that your business takes cyber security seriously.
Cyber Essentials is mandatory for UK central government contracts involving personal data. It is also increasingly required by NHS supplier frameworks, MOD supply chains, and large private sector enterprises as a baseline cyber security requirement.
Businesses that need
Cyber Essentials
How Coreitech gets you
Cyber Essentials accredited
Free Gap Assessment
We map your current IT controls against all five Cyber Essentials requirements — firewalls, secure configuration, access control, malware protection, and patch management — and identify exactly what needs to change.
Technical Remediation
We configure boundary and device firewalls, patch operating systems and third-party software, enforce MFA, tighten access controls, and deploy endpoint protection to meet every CE requirement.
Questionnaire Guidance
We guide you through the IASME self-assessment questionnaire question by question — ensuring every answer is accurate and evidenced before submission to the certifying body.
Certificate Issued
On certification, IASME issues your Cyber Essentials certificate — valid 12 months, with logo rights for your website, proposals, and tenders. We alert you 60 days before renewal.
Cyber Essentials accreditation —
your questions answered
Q.What is Cyber Essentials accreditation?
Cyber Essentials accreditation (also called Cyber Essentials certification) is a UK government-backed scheme that certifies your business has the basic cyber security controls in place to protect against common cyber threats. It covers five key areas: firewalls, secure configuration, access control, malware protection, and patch management. The accreditation is recognised across UK government, NHS, and private sector supply chains.
Q.What is the difference between Cyber Essentials and Cyber Essentials Plus accreditation?
Cyber Essentials accreditation is based on a self-assessment questionnaire reviewed by a certifying body. Cyber Essentials Plus is the higher level — an independent IASME assessor physically tests your systems to verify the controls are working. Cyber Essentials Plus provides a higher level of assurance and is required by some government and NHS supply chains.
Q.How long does Cyber Essentials accreditation take?
For most businesses, Cyber Essentials accreditation takes 2–6 weeks from engagement to certificate. This includes gap assessment, any required remediation, completion of the self-assessment questionnaire, and review by the certifying body. Businesses with modern, well-managed IT environments can sometimes certify within 1–2 weeks.
Q.How much does Cyber Essentials accreditation cost?
The IASME certification fee for Cyber Essentials is approximately £300–£500 depending on your organisation size. Coreitech charges separately for preparation and remediation support — we provide a fixed-price quote based on your current IT environment after a free readiness review.
Q.Do I need Cyber Essentials accreditation?
Cyber Essentials accreditation is mandatory for all UK central government contracts involving personal data or sensitive information. It is also increasingly required by NHS supplier frameworks, MOD supply chains, local government procurement, and large enterprise supply chains. Many businesses also pursue it as a baseline cyber security standard and marketing credential.
Q.What do I need to achieve Cyber Essentials accreditation?
To achieve Cyber Essentials accreditation, your business must demonstrate compliance with five security controls: (1) Firewalls — boundary and device firewalls correctly configured; (2) Secure configuration — devices and software configured to reduce attack surface; (3) User access control — correct account management and admin access restrictions; (4) Malware protection — anti-malware on all devices; (5) Patch management — software and operating systems kept up to date.
Q.Can Coreitech help us achieve Cyber Essentials accreditation?
Yes. Coreitech provides end-to-end Cyber Essentials accreditation support for London and UK businesses. We conduct a gap assessment against the five requirements, carry out any necessary remediation, guide you through the self-assessment questionnaire, and submit your application. Most clients achieve accreditation within 2–4 weeks with our support.
Q.What is included in the £25,000 cyber liability insurance with Cyber Essentials?
Organisations that achieve Cyber Essentials certification and meet certain eligibility criteria (UK-based, annual income under £20 million, primarily digital/online operations) receive £25,000 of cyber liability insurance included free with their certification through the IASME/NCSC scheme. This covers costs arising from a cyber incident. This is automatically provided upon certification — it is one of the most underappreciated benefits of the scheme.
Q.Can I get Cyber Essentials accreditation if I use cloud services like Microsoft 365?
Yes. Cloud services like Microsoft 365 are in scope for Cyber Essentials if they are used to store or process your organisation's data. Microsoft 365 is one of the most commonly used platforms by certified organisations. MFA must be enforced on all Microsoft 365 accounts, and access controls must be correctly configured. Coreitech manages Microsoft 365 configurations as part of the accreditation process.
Q.Does Cyber Essentials accreditation cover remote workers and home devices?
Yes. Remote working devices (laptops, home PCs used for work) that can access your network or organisational data are in scope. BYOD devices may fall out of scope under specific conditions defined in the IASME scoping guidelines. The five controls (especially patching, MFA, and device security) must apply to all in-scope devices regardless of location. This is increasingly important given widespread remote and hybrid working.
Q.Is Cyber Essentials accreditation the same as ISO 27001?
No. Cyber Essentials and ISO 27001 are very different schemes. Cyber Essentials focuses on five specific technical controls and provides a baseline level of cyber security — it is relatively quick to achieve and UK government-backed. ISO 27001 is an international information security management standard requiring a comprehensive Information Security Management System (ISMS) across the whole organisation — it typically takes 6–18 months and is much broader in scope. Many businesses start with Cyber Essentials as a foundation before pursuing ISO 27001.
Q.What is the Danzell update and how does it affect my Cyber Essentials certification?
The Danzell update is the new version of the Cyber Essentials Self Assessment Questionnaire (SAQ), introduced by IASME and the NCSC in April 2026. It introduces stricter requirements in four key areas: (1) Multi-factor authentication — MFA is now required on all cloud accounts, not just admin accounts; (2) Cloud service scoping — stricter rules for what cloud services fall in scope; (3) Patch management — internet-facing services must be patched within 14 days; (4) User access control — stronger controls for hybrid cloud environments. If you previously held Cyber Essentials and are renewing, you may need additional remediation under Danzell. Coreitech guides all clients through the current Danzell SAQ.
Q.What is the scope of Cyber Essentials accreditation?
Scoping is one of the most commonly misunderstood aspects of Cyber Essentials. The scope covers all devices, software, and cloud services that handle your organisation's data — including laptops, desktops, servers, smartphones, tablets, and cloud platforms (Microsoft 365, Google Workspace, AWS, Azure). Devices that are completely isolated from the internet and from your main network can sometimes be excluded. BYOD devices require careful consideration — if they access organisational data or email, they are typically in scope. The Danzell update (April 2026) introduced clearer scoping requirements for cloud services. Coreitech advises on scoping during the initial gap assessment.
Q.How do I know if my business is ready for Cyber Essentials accreditation?
The five areas most businesses fail on when first attempting Cyber Essentials are: (1) Multi-factor authentication not enforced on all cloud accounts (especially Microsoft 365); (2) End-of-life or unsupported software still in use; (3) Administrative accounts being used for everyday tasks; (4) Software not patched within 14 days of release; (5) Default credentials not changed on network devices or routers. If you can confirm all five are addressed, you are likely ready. Coreitech provides a free readiness review — typically 1–2 hours — to assess your current posture against all Danzell requirements and tell you exactly what, if anything, needs to change before assessment.
Q.How does Cyber Essentials renewal work?
Cyber Essentials certificates are valid for 12 months. Renewal requires completing the SAQ questionnaire again (at current year's question set — i.e. Danzell from April 2026) and having it reviewed by the certifying body. Coreitech sends automated renewal reminders 60 days before your certificate expires and manages the renewal process on your behalf. Annual renewal is typically faster than the initial certification (assuming no major IT changes) — most renewals complete within 1–2 weeks. The IASME certification fee is payable again each year.
Ready for Cyber Essentials
accreditation?
Book a free readiness review. We'll assess your current controls, identify any gaps, and give you a clear path to accreditation — typically within 2–4 weeks.