Skip to content
New · AI governance: inventory your AI systems, check the controls, certify ISO 42001.See it
Cyber Essentials

Cyber Essentials: the UK baseline, checked on your real estate

Meet the five control themes of Cyber Essentials with automated checks on your devices, cloud and identity systems, keep the scope current, and take the self-assessed certificate or the hands-on Cyber Essentials Plus audit from the same evidence.

Book a demo

What is Cyber Essentials?

Cyber Essentials is the United Kingdom's government-backed cyber security certification scheme, owned by the National Cyber Security Centre and delivered through IASME and its network of certification bodies. It sets out five technical control themes that stop the majority of common, untargeted attacks: firewalls and boundary devices, secure configuration of devices and software, security update management so that critical and high-risk patches are applied within fourteen days, user access control including multi-factor authentication for cloud services, and malware protection. Two levels exist. Cyber Essentials is a self-assessment questionnaire against the current question set, verified by a certification body; Cyber Essentials Plus adds an independent, hands-on technical audit of a sample of in-scope devices and services, including vulnerability scans and tests of the controls, within three months of the base certificate. Certificates are valid for twelve months and are renewed annually. The scheme is a requirement for many central government contracts involving sensitive data and is widely asked for by UK enterprises and insurers.

In one paragraph

Cyber Essentials is the UK government-backed certification scheme, run by the National Cyber Security Centre and delivered by IASME, that shows an organization has the basic technical controls in place against the most common attacks. It has five control themes: firewalls, secure configuration, security update management, user access control and malware protection. The base certificate is a verified self-assessment; Cyber Essentials Plus adds a hands-on technical audit. Certificates last twelve months, and the scheme is required for many UK public sector contracts.

Who it's for

Companies selling to the UK public sector or to UK enterprises that ask for it, and any small or mid-size business that wants a recognized baseline with a fast route to a certificate.

With Viglyn

How Viglyn runs Cyber Essentials

  • The five control themes mapped to controls, with firewall, configuration, patching, access and malware safeguards checked automatically across your device directory, cloud accounts and identity provider
  • The scope, the in-scope devices and the cloud services, kept current from the MDM and HR syncs rather than a spreadsheet
  • Patch timelines against the fourteen-day requirement tracked in the vulnerability module with the evidence behind them
  • The self-assessment questionnaire answered from your controls, and the Plus audit sample prepared from the same evidence
  • Shared evidence with ISO 27001 and SOC 2, so the UK certificate is a scoped addition rather than a separate program
Straight answers

The Cyber Essentials questions that decide it

Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials when a contract or a customer asks for the certificate and a verified self-assessment is enough; Plus when the buyer wants independent testing, which more public-sector and regulated contracts now require. Plus must follow the base certificate within three months, and Viglyn prepares both from one evidence set.

How long does Cyber Essentials take?

Days for a company whose devices are managed and patched and whose cloud accounts have multi-factor authentication, because the self-assessment is answered from evidence Viglyn already holds. The scope and the unmanaged devices are what take time; the device directory shows them on the first sync.

How much does Cyber Essentials cost with Viglyn?

Cyber Essentials counts as one of the frameworks included in your plan, from $2,699 a year with implementation by our practitioners included. The certification body's assessment fee, set by IASME's bands, is separate and paid by you directly; we take no commission.

FAQ

More Cyber Essentials questions

Is Cyber Essentials recognized outside the UK?
It is a UK scheme and carries most weight with UK buyers, insurers and public bodies. International buyers usually ask for ISO 27001 or SOC 2 instead, which share most of their technical controls with it; in Viglyn the evidence serves all three.
What is in scope?
The whole organization by default, or a defined sub-set with its own network boundary: every device, including home and mobile devices that access organizational data, and every cloud service you use. Scoping decisions must be declared, and Viglyn records them with their reasons.
How often is Cyber Essentials renewed?
Annually. The certificate is valid for twelve months, the question set is updated by the NCSC from time to time, and the controls are expected to be maintained throughout, which is what continuous checks in Viglyn are for.

See Cyber Essentials run on your stack

A 30-minute walkthrough with your systems and your framework. No commitment.