Cyber Essentials certification (UK, NCSC)
UK government-backed scheme built on five technical controls (firewalls, secure configuration, security update management, user access control, malware protection) for the IT infrastructure of an organisation; asked for in UK public and private supplier tenders.
- 0requirementsin our own words
- 1edition Requirements for IT Infrastructure v3.3
- n/aplaces where it is a duty not yet assessed
- 19 Oct 2026last checkedat the sources below
This programme is listed before its requirements and its place rules are written. Both follow; until then the page states what the scheme is and who owns it.
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| Requirements for IT Infrastructure v3.3 | Current Requirements document dated April 2026 on the NCSC resources page; adds a definition of cloud services, FIDO2 in passwordless authentication and states that cloud services cannot be excluded from scope. | Apr 2026 | Not stated | None named |
About the programme
- Assessed by
- A certification body licensed by the scheme owner
- Scope
- organisation or defined subset of its IT infrastructure
- Levels
- Cyber Essentials (verified self-assessment) and Cyber Essentials Plus (adds independent testing)
- Validity
- Certificate validity period not stated on the NCSC pages read.
- Accreditation route
- Certification bodies licensed by IASME, the NCSC delivery partner
- Recognised by
- NCSC
- Official body
- National Cyber Security Centre (NCSC), UK
- Who asks for it
- Public tenders
- Where it is used
- GB (open to organisations anywhere)
Sources
Official bodies behind this page, each with the date we last read it.
- GOV.UKread 19 Oct 2026
Not legal advice. Confirm each duty against the text itself.