Home / Guides / Cyber Essentials UK
UK NCSC & IASME COMPLIANCE

Cyber Essentials Certification Guide & Technical Readiness Audit for UK SMEs

Author: Abin Babu (That's Grand) Target: UK Businesses & Consultancies Standard: NCSC Montpelier & IASME CE v3.2
Achieving Cyber Essentials certification has become a prerequisite for winning UK government tenders, working with corporate supply chains, and obtaining affordable cyber liability insurance. This guide details how UK small and medium enterprises can audit, remediate, and pass the 5 NCSC technical controls on their first submission.

Why UK Businesses Need Cyber Essentials

The Cyber Essentials scheme was launched by the UK Government's National Cyber Security Centre (NCSC) to protect organizations against 80% of common cyber threats. While initially adopted primarily by defence contractors, it is now standard procurement criteria across:

  • UK Public Sector & Government Tenders: Mandatory for Central Government, Ministry of Defence (MoD), and NHS supply chains handling sensitive data.
  • Enterprise B2B Bidding: Corporate clients (banks, management consultancies, legal firms) require subcontractors to prove verified baseline security.
  • Cyber Insurance Underwriting: Most UK commercial insurers require Cyber Essentials or heavily discount premiums for certified companies.
  • Ransomware & Phishing Immunity: The five controls eliminate opportunistic attacks, credential stuffing, and unauthenticated RCE exploits.

The 5 Core Technical Controls: What Assessors Check

Whether applying for standard Cyber Essentials (verified assessment) or Cyber Essentials Plus (hands-on vulnerability scan), your infrastructure must strictly satisfy five technical pillars:

1. Boundary Firewalls & Internet Gateways

CONTROL 01

Every device connected to the internet must be shielded by an effectively configured firewall. For cloud infrastructure (AWS, DigitalOcean, Oracle Cloud), this means:

  • Security Groups and network ACLs must deny all inbound traffic by default.
  • Administrative ports (SSH 22, RDP 3389, database ports 3306/5432) must never be open to `0.0.0.0/0`. Access must be restricted to static management IPs or authenticated VPNs.
  • Default router and server firewall passwords must be changed immediately upon deployment.

2. Secure Configuration

CONTROL 02

Out-of-the-box system configurations prioritize ease-of-use over security. Under this control, you must prove:

  • Removal or disabling of all unnecessary user accounts, guest profiles, and demo databases.
  • Disabling of unneeded server daemons, background services, and outdated cipher suites (TLS 1.0/1.1 disabled).
  • Enforcement of auto-lock screens (15 minutes maximum) and account lockout after repeated failed logon attempts.

3. User Access Control & Multi-Factor Authentication (MFA / 2FA)

CONTROL 03

Credential compromise is the #1 vector for data breaches. Cyber Essentials enforces rigorous identity boundaries:

  • Mandatory MFA on Cloud Services: Microsoft 365, Google Workspace, AWS Management Console, and CMS admin portals (WordPress, Magento) MUST enforce MFA for all users, especially administrators.
  • Separation of Duties: Staff must not conduct day-to-day work (browsing, email) using administrative accounts. Dedicated admin credentials must be used solely for management tasks.
  • Least-Privilege Access: AWS IAM roles and folder permissions restricted to the exact resources required.

4. Malware Protection

CONTROL 04

Protection against virus, trojan, and spyware execution. Required measures include:

  • Centrally managed anti-malware software with signature files updated daily.
  • Application allowlisting (or operating system execution controls like Windows Defender / AppLocker) to prevent untrusted binary execution.
  • Web browser sandboxing and file download scanning.

5. Security Update & Patch Management (The 14-Day Rule)

CONTROL 05

This is where 70% of first-time applicants fail. The NCSC strictly requires that:

  • All operating systems, web applications, and plugins must be supported by the vendor (no end-of-life Windows 7, Ubuntu 16.04, or PHP 7.x without active security support).
  • High-severity vulnerabilities (CVSS 7.0+) must be patched within 14 days of release. Recent examples include the critical PHP2Shell vulnerabilities (CVE-2026-109618).
  • Automatic updates enabled across all client workstations and server operating systems.

Real-World Case Study: UK Strategy & Business Advisory Firm

A fast-growing UK management advisory consultancy needed to qualify for government advisory tenders. Their environment consisted of legacy shared email, unmonitored laptops, and a newly planned AWS cloud deployment.

How That's Grand Executed Full Readiness

  • Cloud Architecture: Built a dedicated AWS operational environment with hardened security groups, IAM least privilege, and automated encrypted backups.
  • Microsoft 365 Migration: Migrated all user mailboxes to Microsoft 365, enforced conditional access 2FA for all team members, and configured strict SPF, DKIM, and DMARC DNS policies.
  • Technical Remediation: Audited all endpoints, ensured OS patch compliance within the 14-day rule, and coordinated with their enterprise software partners.
  • Outcome: Passed Cyber Essentials readiness verification on the first pass, enabling the client to successfully bid on lucrative UK public sector contracts.

How Our Pre-Assessment Audit Works (Safe & Non-Destructive)

Preparing for an official Cyber Essentials Plus evaluation shouldn't cause disruption or security concerns. We conduct audits with strict protocols to guarantee system stability and absolute confidentiality:

1. Authorized Scope & Formal Consent

STEP 01

Before any testing begins, we issue our standard UK Pre-Audit Scope Agreement adhering to the Computer Misuse Act 1990. We agree on the exact target domain names, IP addresses, and preferred testing window (e.g., off-peak or evening hours).

2. Safe Perimeter Whitelisting

STEP 02

Official IASME certification assessors evaluate perimeters using automated scanners. If your cloud firewall or Fail2ban automatically blocks testing traffic, the official audit fails. Under our guidance, you temporarily allow our dedicated testing address so we can identify weaknesses before official submission.

3. Zero-Password External Vulnerability Scan

STEP 03

We never ask for your server passwords, database credentials, or root keys. Testing is conducted externally against your public IP, inspecting service banners, SSL/TLS ciphers, and checking software against the NCSC 14-day high-risk patch rule with zero risk of service disruption.

4. Plain-English Remediation Report

STEP 04

You receive an executive gap report categorizing findings by CVSS severity with prioritized, step-by-step remediation commands. We verify all fixes so you submit your application with 100% confidence.

OUR PRIVACY & SECURITY GUARANTEE

• Zero Administrative Access: No root keys, administrative passwords, or database credentials required.
• Non-Destructive Testing: Safe vulnerability probes — zero denial-of-service, zero data modification, zero downtime.
• Strict Confidentiality: All technical findings and architecture reviews are protected under NDA.

Frequently Asked Questions (FAQ)

Can an SME pass Cyber Essentials without a dedicated in-house IT department?
Yes. In fact, most UK SMEs outsource their technical readiness to an infrastructure and security specialist. We audit your existing accounts, configure the required policies (such as M365 2FA and AWS security groups), and provide the exact technical documentation needed for your certification application.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both certifications evaluate the identical five technical controls. Cyber Essentials is a verified self-assessment questionnaire approved by an IASME-licensed assessor. Cyber Essentials Plus includes the assessment plus an independent technical audit and internal/external vulnerability scan conducted directly against your endpoints and cloud servers.
How long does a Cyber Essentials Readiness Audit take?
For an SME with 5 to 50 users, a technical gap audit typically takes 24 to 48 hours. Remediation (fixing open ports, enforcing 2FA, patching out-of-date PHP or server packages) is completed within 3 to 5 business days, ensuring your application passes without rejection fees.
Does Cyber Essentials cover cloud hosting and servers?
Yes. Any cloud service (AWS, Azure, CloudPanel, SaaS applications) that processes or stores your company data falls directly into the assessment scope and must comply with the firewall, access control, and patch management rules.
Do I need to provide server passwords or root access for the audit?
No. We adhere to a strict Zero-Password policy. The audit is performed externally against your public IP address. You never share passwords, root keys, or database credentials.
Will the vulnerability scan slow down or crash our production website?
No. Our testing is 100% non-destructive. It uses lightweight discovery probes and version checking. We never perform denial-of-service tests or destructive payloads, ensuring zero downtime for your visitors.
FAST-TRACK AUDIT

Get Your Infrastructure Cyber Essentials Ready

Don't risk failing your IASME assessment or losing client bids. We perform a complete pre-audit gap analysis across AWS, Microsoft 365, and your web servers, remediating open vulnerabilities so you pass with confidence.

Chat on WhatsApp (+44 7776812268) → Email for Audit Scope →