The Cyber Essentials scheme defines five technical controls. Every certificate, Basic or Plus, evidences that all five were in place on assessment day. This page summarises what each control requires, what the IASME-authorised assessor checks, and where firms most often have gaps.
Boundary firewalls and personal firewalls block unauthorised inbound traffic and restrict outbound connections to known-good destinations.
Read the firewalls detailDevices and software are configured to remove or disable unused services, change default passwords, and apply secure baseline settings.
Read the secure configuration detailAccess to data and services is controlled through individual accounts with appropriate privileges, and administrative privileges are tightly restricted.
Read the user access control detailEvery in-scope device runs malware protection (anti-virus or equivalent) configured to scan in real-time and update its signatures regularly.
Read the malware protection detailAll software is kept up-to-date and patches for high-severity and critical vulnerabilities are applied within 14 days of vendor release.
Read the patch management (security update management) detailThe five controls are not independent. A user-access-control failure (e.g. MFA disabled on a senior account) often rides on a secure-configuration failure (e.g. the policy that should have enforced MFA was relaxed for an integration). A patch-management failure (e.g. a 9-month-old browser plug-in vulnerability) is closely linked to malware-protection (the unpatched plug-in is exactly the surface anti-virus is supposed to defend).
The Cyber Essentials Plus assessment treats them as a single package. A failure on one control during assessment day prevents certificate issue regardless of how strong the other four are. That is why the typical CE Plus engagement scopes the gap list across all five before the formal assessment, fixes the gaps, then runs the formal assessment with high confidence of first-time pass.
Per the Danzell scheme update from April 2026, year-round vulnerability scanning and patching is now the Cyber Essentials baseline, not the upgrade. The Cyber 365 programme delivers that year-round discipline so the controls stay in shape between assessment days.