How to Get Cyber Essentials Certified: A Step-by-Step Guide for North East Organisations

Cyber Essentials is the UK government-backed scheme that certifies an organisation has a baseline set of technical controls in place against the most common internet-based attacks. For organisations across the North East, it often arrives as a requirement: a council tender, an NHS supplier framework, a defence supply chain contract or a larger customer's supplier onboarding form. It is also one of the most cost-effective security improvements a small or medium organisation can make, because the controls it requires address the attacks that actually hit SMEs.

This guide explains how certification works, the difference between Cyber Essentials and Cyber Essentials Plus, and how to prepare so you pass first time. For the detail of what changed in the 2026 requirements, see our companion article on Cyber Essentials Danzell evidence requirements.

Cyber Essentials versus Cyber Essentials Plus

• Cyber Essentials is a verified self-assessment. You answer a question set describing how your organisation meets the requirements, a senior person signs a declaration, and an assessor at a certification body reviews it.
• Cyber Essentials Plus has the same requirements but adds a hands-on technical audit. An assessor tests a sample of your devices and accounts, including checks on patching, malware protection, MFA and how email and web attachments are handled. You must hold Cyber Essentials before taking Plus, within a defined window.

Both certificates are valid for twelve months. The scheme is delivered by IASME on behalf of the NCSC, through a network of licensed certification bodies.

The five technical controls

All Cyber Essentials requirements sit under five control themes:

• Firewalls: boundary and device firewalls configured to block unauthorised inbound connections, with default passwords changed and administrative interfaces protected.
• Secure configuration: removing unnecessary software and accounts, changing defaults, and disabling auto-run.
• Security update management: supported software only, with high and critical updates applied within 14 days of release.
• User access control: accounts created and removed through a process, least privilege, separate administrative accounts, and multi-factor authentication on cloud services.
• Malware protection: anti-malware or application allow-listing on in-scope devices.

Step 1: Define your scope

The default and recommended scope is the whole organisation. You can set a narrower scope for a separately managed sub-set, but it must be defined by a network boundary, and anything outside it must be declared. Under the current requirements, cloud services cannot be excluded from scope: if your organisation uses Microsoft 365, Google Workspace, AWS or another cloud service, those accounts are in scope. Include all end-user devices that access organisational data or services, including bring-your-own devices used for work email.

Step 2: Build an accurate inventory

You need to list operating systems, versions, network equipment and cloud services. Many failures start here: an unsupported Windows version on a reception PC, an old router at a branch office, a forgotten SaaS account. If software is no longer supported by the vendor, it must be removed or segregated out of scope.

Step 3: Close the automatic-fail gaps first

Some questions are treated as automatic failures if the answer is wrong. The 2026 Danzell question set, which applies to assessment accounts created from 27 April 2026, makes these especially important:

Step 4: Complete the self-assessment honestly

Answer each question with enough detail for the assessor to understand how you meet it. Vague answers such as "yes" or "we use antivirus" lead to queries or failure. Describe the specific product, setting or process. The declaration must be signed by a board-level or equivalent senior person, and it is a statement of fact about your organisation, so it should be checked by someone who understands the technology.

Step 5: Prepare for the Plus audit if required

For Cyber Essentials Plus, assume the assessor will find anything you have not checked. Before the audit, sample your own devices: confirm patches are current, test that malware protection blocks a harmless test file, check that MFA prompts appear on cloud services, and confirm that users do not have administrative rights. Keep evidence of the checks you made.

Why organisations fail and how to avoid it

• Older devices or software that are no longer supported but still in use.
• MFA enabled for administrators but not standard users.
• Patching that works for Windows but not for firewalls, routers or phones.
• Cloud services left out of the inventory.
• Answers that describe policy rather than what is actually configured.

Regular visibility helps. PyraLink Prove checks cloud configuration, including MFA and administrative access, so gaps show up before the assessor finds them.

Support in the North East

North East organisations have useful regional support. The North East Business Resilience Centre, part of the national network of police-led cyber resilience centres, offers guidance to small businesses, and the NCSC publishes free resources such as the Small Business Guide. Certification itself must be carried out by an IASME-licensed certification body, which you can find through the IASME website.

Making Cyber Essentials stick between renewals

Certification is a snapshot of one day. The value comes from keeping the controls in place all year, because the attacks they prevent do not wait for your renewal date. Three habits make the biggest difference. First, keep the device and software inventory current, adding new starters' laptops and removing leavers' accounts as part of HR processes rather than as an annual clean-up. Second, monitor patch compliance monthly, including routers, firewalls and phones, which are the devices most often forgotten. Third, review cloud administrator accounts and MFA status every quarter, since exceptions created for a quick fix tend to become permanent.

Plan the renewal at least two months ahead. The question set is updated periodically, as the 2026 Danzell changes showed, and a change in requirements is much easier to absorb with time to spare. If you hold Cyber Essentials Plus, remember the technical audit has its own timing rules relative to your basic certification, so check with your certification body when you book.

Finally, treat assessor feedback as useful intelligence. Questions an assessor queried this year are likely to be the areas where your controls or your descriptions of them are weakest, and they are a good starting point for wider improvements.

How Pyralink helps

PyraLink™ Prove collects read-only configuration evidence from your cloud and Microsoft 365 accounts, such as MFA enforcement, that you can check against the Cyber Essentials requirements before your assessment. Certification is issued by an IASME-licensed certification body. Where Cyber Essentials is a stepping stone, read our guides to ISO 27001 certification and zero trust principles.

Frequently asked questions

How long does Cyber Essentials certification last?

Cyber Essentials and Cyber Essentials Plus certificates are valid for twelve months. You must recertify each year to remain certified.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment. Cyber Essentials Plus has the same requirements but adds a hands-on technical audit of a sample of your devices and accounts by an assessor.

Is MFA mandatory for Cyber Essentials?

Yes. Multi-factor authentication must be enabled on cloud services wherever it is available, for all users. Under the Danzell requirements a failure here is an automatic fail.

Can I exclude cloud services from Cyber Essentials scope?

No. Cloud services used by the organisation cannot be excluded from scope under the current requirements.

Who issues Cyber Essentials certificates?

Certificates are issued by certification bodies licensed by IASME, which delivers the scheme on behalf of the NCSC.

Running on Google Cloud? Our Cyber Essentials on Google Cloud checklist shows which GCP settings evidence each of the five technical controls.

Sources: NCSC: Cyber Essentials overview; IASME: Changes to Cyber Essentials for April 2026; IASME: Cyber Essentials; NCSC: Small Business Guide; North East Business Resilience Centre.