The scheme is overseen by the National Cyber Security Centre and delivered through its partner IASME. There are two levels. For Cyber Essentials, an organization completes a self-assessment questionnaire that a certification body reviews. Cyber Essentials Plus covers the same controls but adds hands-on technical testing by an independent assessor. Certification lasts twelve months and must then be renewed.
The five controls address the most common, low-skill attacks, so the scheme is a practical baseline for a small organization. Certification is required for some UK government contracts, and some larger customers ask their suppliers for it. It gives customers and insurers a recognized signal that basic protections are in place, and preparing for it often exposes gaps nobody had noticed.
Certification covers a defined scope at a point in time; it does not make an organization immune to attack. The requirements are specific, including multi-factor authentication for cloud services and prompt installation of security updates, and unsupported software in scope will cause a failure. We implement the technical controls and help gather evidence, but certification is assessed and awarded only by a licensed certification body, not by us.