What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme designed to help organisations defend against the most common cyber threats. Managed by the National Cyber Security Centre (NCSC), it provides a clear, auditable baseline that demonstrates your organisation takes cybersecurity seriously.
There are two levels:
- Cyber Essentials — a self-assessment questionnaire verified by an accredited certification body
- Cyber Essentials Plus — an independent technical audit performed by a certified assessor
Who Needs It?
Cyber Essentials is mandatory for any organisation bidding for UK government contracts involving the handling of sensitive or personal information. Beyond that, many large enterprises now require it from their supply chain as part of third-party risk management programmes.
Regulated sectors where certification is increasingly expected:
- Financial services — FCA-regulated firms use it as a baseline control framework
- Healthcare — NHS Digital mandates it for suppliers accessing NHS systems
- Legal — The Law Society and SRA recommend it for firms handling client data
- Defence — MOD contractors must hold Cyber Essentials Plus
The Five Technical Controls
Cyber Essentials assesses five areas of cybersecurity hygiene:
- Firewalls — boundary and software firewalls configured to block unauthorised access
- Secure configuration — systems configured securely, removing unnecessary software and features
- User access control — principle of least privilege, multi-factor authentication for cloud services
- Malware protection — anti-malware software, application allowlisting, or sandboxing
- Patch management — critical patches applied within 14 days of release
How Rhentech Helps
Our Cyber Essentials preparation service covers:
- Gap assessment — we audit your current posture against all five control areas
- Remediation support — we fix the gaps, not just identify them
- Questionnaire guidance — we walk you through the self-assessment with evidence templates
- Certification support — we liaise with the certification body on your behalf
Most organisations can achieve Cyber Essentials within four to six weeks with proper preparation. Cyber Essentials Plus typically requires an additional two to four weeks.
Common Pitfalls
Scoping errors are the most frequent cause of failed assessments. Many businesses assess only their corporate network and forget cloud services, mobile devices, or remote worker environments. All assets that access organisational data must be in scope.
MFA gaps are now heavily scrutinised. Since the April 2023 update to the scheme, multi-factor authentication is required for all cloud services — not just admin accounts.
Patch compliance is often the hardest control to achieve. Legacy systems that cannot be patched within 14 days must either be isolated or replaced.
Getting Started
Contact Rhentech for a free Cyber Essentials readiness assessment. We’ll tell you exactly where you stand and what needs to be done — with no jargon and no obligation.