What is Cyber Essentials?

Cyber Essentials works by having an organisation answer a self-assessment on five security controls, which an independent assessor then marks. It is a UK government-backed scheme, set out by the National Cyber Security Centre (NCSC). Buyers ask suppliers for it in tenders, the formal invitations to bid for a contract, and in the supplier questionnaires they send before taking a supplier on.

The five controls Cyber Essentials checks

Cyber Essentials requirements are five technical controls on an organisation's own IT, and certification confirms that all five are in place. The NCSC names them as follows:

• Firewalls: controlling the traffic between the organisation's devices and the internet.
• Secure configuration: changing default settings and removing software and accounts that are not needed.
• Security update management: installing the software updates that fix security flaws.
• User access control: giving each person only the accounts and access rights they need for their work.
• Malware protection: protecting the organisation's devices against malicious software.

Cyber Essentials certification is a self-assessment that an independent assessor checks. IASME describes it as an independently verified self-assessment. The organisation answers questions about its own setup, and an assessor reviews those answers before issuing a certificate.

What the scheme leaves out matters as much as what it covers. All five controls concern devices, networks and accounts. None of them says how a supplier handles a buyer's information during a contract, or how it responds when a security incident happens. The NCSC's requirements document for IT infrastructure states that backing up data is not one of the scheme's technical requirements. A certificate is therefore no evidence of backup or recovery arrangements, and a supplier that holds one has shown the five controls and nothing beyond them.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials Plus checks the same five controls as Cyber Essentials, and adds a hands-on technical audit to the self-assessment. Both levels share the same technical requirements. Plus starts with the basic questionnaire, then an assessor audits the organisation's IT systems to verify the controls are in place. The NCSC describes this as independently testing that the controls work in practice.

That audit raises the pass bar. When it finds a control that is not met, known as a non-compliance, the applicant has 30 days to fix it. It cannot pass until the fix is made. At the basic level, the assessor's check rests on the organisation's own answers, with no test of the systems themselves.

For a supplier, the two levels are different pieces of evidence. A basic certificate shows that the organisation declared the five controls and had that declaration checked. A Plus certificate shows that an assessor has also tested those controls on its systems. The level a buyer needs is set in its tender documents, and a basic certificate does not meet the Plus requirement.

Where Cyber Essentials sits in a tender

In a tender, Cyber Essentials appears as a requirement that the supplier answers by providing details of its certificate, such as its level, date and what it covers. It can appear in a selection questionnaire, an early stage where a buyer checks whether a supplier qualifies before scoring its full response. It can also come up in a supplier questionnaire sent before a contract starts.

The tender's documents say how the requirement is judged. It may be pass/fail, meaning a response without the certificate is ruled out before its answers are read. Alternatively, the buyer may accept other evidence of the same controls. For UK central government departments, their agencies and NHS bodies, Procurement Policy Note 014 tells buyers whose contract requires Cyber Essentials to ask for a certificate at either level, or equivalent, before contract award.

A buyer checks more than whether a certificate exists. A certificate's scope is the part of the organisation and its IT that the assessment covered, and it can be narrower than the whole business. The NCSC's Cyber Essentials supply chain playbook tells buyers they are responsible for checking that the scope covers the risk they take on by contracting with the supplier. Buyers look the supplier up on IASME's public certificate search. If the scope leaves out the team or systems that would deliver the contract, the certificate may not satisfy the buyer for that contract.

How a certificate works in a security questionnaire

In a security questionnaire, a Cyber Essentials certificate answers the questions on its five controls, and the remaining questions still need written answers. A security questionnaire is a buyer's list of questions on how a supplier protects its systems and the buyer's information. The NCSC suggests that buyers align these questionnaires with the Cyber Essentials controls and accept a certificate as validation of them.

Take a small firm with a basic Cyber Essentials certificate covering its whole business, answering a prospective buyer's security questionnaire before a services contract. The questionnaire asks whether the firm uses firewalls and how it keeps its software up to date. It also asks who holds administrator accounts and how devices are protected against malware. Where the buyer has aligned its questionnaire with NCSC guidance, the firm answers each question by citing its certificate and attaching it.

The same questionnaire also asks how the firm backs up its data and how it would detect, contain and recover from an incident. It asks how the firm would handle the buyer's information during the contract. The certificate provides no evidence of any of these, so the firm writes out each answer and supports it with its own policies and records. Writing those answers so that they hold up when the buyer checks them is covered in defensible security questionnaire answers.

A buyer that has not aligned its questionnaire may ask the firm to describe the five controls in its own words. In that case, the certificate sits beside those answers as supporting evidence. Some questionnaires also ask for ISO 27001, an international standard for running a whole information security management system. That goes well beyond the five controls, so a Cyber Essentials certificate is a different, narrower piece of evidence. The full process of responding to a security questionnaire covers both kinds of questions.