Cyber Essentials for software companies

What Cyber Essentials is

A UK government-backed certification, overseen by the National Cyber Security Centre and delivered by IASME, showing that an organisation has five basic technical controls in place. You answer a self-assessment questionnaire, a certification body reviews it, and a director signs to say the answers are true.

Why it matters: It is the most common security certification UK buyers ask a small supplier for, and it is cheap and quick next to SOC 2 or ISO 27001. For a UK software company it is often the first certification worth getting.

What good looks like

• The whole company in scope, not one office or one product
• Every cloud service your staff use included, since none can be excluded
• A named person who keeps the answers true all year, not just on assessment day
• Renewal booked before the 12 months run out

The five controls

Firewalls, secure configuration, security update management, user access control and malware protection. They apply to every device and cloud service that can reach the internet and handles company data, including staff laptops and phones used for work.

Why it matters: They are the controls that stop most common attacks: stolen passwords, unpatched software and default settings. A buyer who sees the certificate knows these basics are covered without asking about each one.

What good looks like

• Multi-factor authentication on every cloud service that offers it
• High and critical updates installed within 14 days of release
• Default passwords changed and unused accounts removed
• Admin rights kept to the people who need them

What changed in April 2026

The Danzell question set replaced Willow for assessments started from 27 April 2026. The five controls are the same, but some answers now fail an assessment outright: no MFA on a cloud service that supports it, or high and critical updates not installed within 14 days.

Why it matters: Companies that passed easily in earlier years can fail on MFA or patching now. Check both before you start the questionnaire, not after.

What good looks like

• MFA confirmed on every cloud service, including small ones
• A patching record showing updates within 14 days
• Cloud services listed in scope rather than left out

Cyber Essentials Plus

The same five controls, verified by an independent technical audit: an assessor tests a sample of your devices and checks your internet-facing systems. You need Cyber Essentials first.

Why it matters: Some buyers, larger public sector contracts and insurers ask for Plus rather than the self-assessment, because someone has checked the controls rather than taken your word for them.

What good looks like

• Cyber Essentials passed first, with Plus booked soon after
• A representative sample of devices ready for testing
• Any findings fixed and retested before the deadline

What it costs

IASME sets the Cyber Essentials fee by organisation size, from £320 plus VAT for up to nine employees and rising for larger organisations. Plus is priced by the certification body that audits you and depends on the size of your estate, so get quotes.

Why it matters: It is one of the few security certifications a small company can budget for on a credit card, and it renews every year at a similar cost.

What good looks like

• The fee for your size band confirmed on IASME's site
• Time set aside to answer the questions properly, not just the fee
• Renewal in the budget for next year

Who asks for it

Since October 2014, the UK government has required Cyber Essentials from suppliers bidding for certain contracts that involve personal and sensitive information. Many UK companies, public bodies and insurers now ask their suppliers for it too.

Why it matters: If you sell to UK customers, expect it on security questionnaires and procurement forms. Having it ready saves a round of questions about each of the five controls.

What good looks like

• Your certificate number and expiry date to hand
• A clear answer on whether you hold Cyber Essentials or Plus
• A plan for the next renewal if yours expires during a deal

Showing it to buyers

Put your Cyber Essentials status on your trust center with the date it runs to, and make the certificate available. If you're still working towards it, say so rather than leaving it off.

Why it matters: A buyer's reviewer checks the certificate's dates and scope. When they're on the page, the question is settled before the questionnaire arrives.

What good looks like

• Status shown as certified, or in progress while you work towards it
• The certificate public, or behind an access request if you prefer
• The expiry date visible, and updated at each renewal

Notice Labs lists Cyber Essentials and Cyber Essentials Plus in its compliance catalog, marked certified, aligned or in progress. It shows your status; it doesn't certify you.