The five controls
The NCSC lists five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
Two routes
On the self-led route you register via IASME, pay and complete a verified self-assessment. A board member or equivalent signs off the answers and an assessor marks them. On the supported route a Certification Body licensed by IASME helps you interpret the questions.
What Plus adds, and the cost
Cyber Essentials Plus covers the same controls and adds more rigorous, independent technical testing. Basic certification starts at £320 plus VAT, scaled to organisation size. UK organisations with turnover under £20m whose certification covers the whole organisation also get cyber liability insurance arranged by IASME.
Who decides
The assessor decides, not you and not any preparation service. A gap list helps you find work to do before you are marked, but it cannot promise a pass.
- List every device and account in scope.
- Check each against the five controls.
- Keep an evidence file for each answer.
Sources and limits
- NCSC: Cyber Essentials overview Checked 2026-10-12.
- The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection.
- There are two routes: self-led, where you register via IASME, pay and complete a verified self-assessment that a board member or equivalent signs off and an assessor marks, or supported, through a Certification Body licensed by IASME.
- Cyber Essentials Plus covers the same controls and adds more rigorous, independent technical testing.
- Basic Cyber Essentials starts at £320 plus VAT, scaled to organisation size, and cyber liability insurance arranged by IASME comes with certification for a UK organisation with turnover under £20m whose certification covers the whole organisation.