Cyber Essentials
ASK US ABOUT THISCyber Essentials is the UK Government backed certification scheme that sets out five practical technical controls to stop the cyber attacks most businesses actually face, things like phishing, stolen passwords and unpatched software. It was developed by the National Cyber Security Centre (NCSC) and gives you a clear, achievable baseline rather than an open ended list of best practice.
It works a little like a pre MOT checklist. You complete a self assessment describing how your IT environment is set up. A qualified assessor reviews your answers and where the five controls genuinely stack up, certification follows.
Important Changes from 27th April 2026
Every new Cyber Essentials assessment now uses the Danzell question set, version 3.3 of the NCSC requirements. The five controls haven't changed but the marking has, considerably. Two changes catch businesses out most often.
- Cloud services such as Microsoft 365 can no longer be excluded from scope. If it holds your organisation's data it has to be included.
- Critical and high risk security updates must be applied within 14 days. Miss that window on even one device and it's an automatic fail.
- Multi Factor Authentication (MFA) must be switched on for every cloud service that offers it. Miss one and the entire assessment fails automatically.
For many businesses this means Cyber Essentials has quietly become a lot harder to pass on paper alone.
The Five Controls Cyber Essentials Covers
Firewalls
Prevent unauthorised access between your network and the internet by keeping internet facing devices and services securely configured.
Malware Protection
Stop malicious software from running and causing damage, whether through anti malware tools, application allow listing or another approved approach.
Secure Configuration
Remove or disable default settings, unused accounts and unnecessary software so devices are set up securely from the start.
Security Update Management
Keep software and operating systems supported and patched, with critical and high risk vulnerabilities fixed fast.
User Access Control
Give people access only to what their role needs and keep administrative accounts separate from everyday use.
How Certification Works
Cyber Essentials is a verified self assessment. Your organisation defines what's in scope, completes a detailed questionnaire covering the five controls, then a qualified assessor reviews it. Getting the scope right matters more than most businesses expect. Unsupported software, weak admin controls, missing patches or inconsistent MFA are the most common reasons an assessment stalls.
How LoughTec Helps
- Assessing user and administrative access
- Defining the correct assessment scope
- Identifying unsupported or non compliant systems
- Interpreting the Danzell requirements for your environment
- Preparing for submission with confidence
- Remediating technical gaps before you apply
- Reviewing firewall and security configurations
- Reviewing MFA coverage across cloud services
- Reviewing patching and vulnerability management
Why It's Worth Doing
Certification is increasingly requested in tenders and supplier onboarding, not just government contracts. Beyond that it:
- Demonstrates to customers and partners that you take security seriously
- Gives your team a genuine baseline to build further security on
- Meets a growing number of supply chain and procurement requirements
- Reduces your exposure to the phishing and malware attacks that cause most breaches
- Strengthens your overall governance and risk position
Eligible UK organisations achieving Cyber Essentials across their whole organisation may also qualify for free cyber liability insurance arranged through IASME, up to £25,000 cover for businesses with turnover under £20 million, subject to terms and conditions.
Cyber Essentials Is The Baseline, Not The Finish Line
It won't stop every attack. Credential theft, ransomware and supply chain compromise all sit beyond its scope, but it gives you a solid, independently reviewed starting point.
Need help achieving Cyber Essentials under the latest Danzell requirements?
Enquire below to speak to LoughTec about readiness, remediation and certification support.
