Cyber Essentials is described by the National Cyber Security Centre as the minimum standard of cyber security recommended by Government for organisations of all sizes. Increasingly it appears in tender documents, which is how most organisations first meet it.
It asks about five technical controls. This is what each one means in ordinary language, and how to tell whether you would pass today.
Firewalls
The scheme describes this as a security filter between the internet and your network. In practice it asks whether the boundary between your organisation and everything else is controlled, and whether the devices that leave the building have their own protection.
The two things that catch people out are default administrative passwords still in place on the boundary device, and services exposed to the internet that nobody remembers opening. Remote access left over from a supplier visit is the classic example.
Secure configuration
Computers set up so there are fewer ways in. That means removing software nobody uses, turning off features nobody needs, and not leaving anything on a supplier’s default settings.
Accounts are part of this. Unused accounts get removed, and default ones get renamed or disabled. It is unglamorous work and it is where a great deal of risk actually sits.
Security update management
Closing known holes before somebody uses them. The scheme expects updates to be applied, and it expects software that no longer receives them to be removed or replaced.
This is where end of support dates stop being an IT detail. Software past its support date cannot be patched, so it cannot satisfy this control. The dates are published years ahead, which makes the work predictable.
The April 2026 question set tightened this. Two questions about installing critical updates within fourteen days of release became conditions that fail an assessment outright rather than points to improve on.
User access control
Who can reach your data and services, and at what level. Ordinary users do not hold administrative rights for their day to day work, administrative accounts are separate and used deliberately, and access is removed when somebody leaves.
Multi factor authentication belongs here, and the April 2026 changes made it mandatory for all cloud services where the service offers it. This is now something an assessment fails on rather than notes.
If you do only one thing after reading this, check that every account with administrative rights has multi factor authentication on it.
Malware protection
Malicious software identified and stopped before it does harm. For most organisations this means the protection built into the operating system, kept switched on and kept current, rather than something bought separately.
What matters for the assessment is that it is on everywhere, including the machines somebody set up in a hurry, and that nobody has quietly excluded a folder to stop a warning.
The two routes through the scheme
The NCSC describes a self led route, where you complete a verified self assessment, and a supported route, where a licensed Certification Body helps you through it. There is also a more thorough version where the controls are tested rather than declared.
Whichever route you take, the honest work happens before the questionnaire. Answering yes to a question you have not checked is the one mistake worth avoiding, because the certificate is only useful if it is true.
What changed in April 2026
The five controls themselves did not change. The question set did. The current set is named Danzell, published in February 2026 and applying to assessments created after 26 April 2026, with a transition period for accounts opened before then.
The two practical changes are the ones above: multi factor authentication on cloud services, and critical updates within fourteen days. Both are conditions that fail an assessment, so both are worth confirming before you start.
How to find out where you stand
Read the five headings and answer each one honestly for your own organisation. Where the answer is “probably”, that is the work. Where it is “I do not know”, that is the first thing to look at.
Most organisations find the gap is smaller than they feared and sits mostly in the second and fourth controls. Our approach to this kind of work is on the cybersecurity page, with related detail on devices and endpoint management. If you would like a view on which of the five would hold up today, get in touch and we will talk it through.