Cyber Essentials
Government buyers and larger clients increasingly ask suppliers for Cyber Essentials, and the April 2026 rules are stricter. We get your Macs, PCs, phones and Microsoft 365 ready, fix the gaps, then take you through assessment with our certification partner, which is licensed by IASME. We hold Cyber Essentials and Cyber Essentials Plus ourselves.
The readiness review
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
5
technical controls, the same for Cyber Essentials and Plus
14 days
to install critical and high-risk security updates
12 months
before a certificate needs renewing
3 months
to complete Plus after your Cyber Essentials certificate
Sources: NCSC Cyber Essentials requirements v3.3, April 2026, and IASME, the NCSC’s Cyber Essentials delivery partner.
Most organisations already have the right tools. The gaps are in the detail.
Scenario 1
Since 27 April 2026, multi-factor authentication is mandatory on every cloud service that offers it, free or paid. IASME says missing it is an automatic fail.
What you can doWe list your cloud services, switch on MFA, and enforce it in Microsoft 365 with conditional access. A Microsoft 365 health check shows where MFA is missing.
Scenario 2
Every device that accesses organisational data is in scope, including personal phones.
What you can doWe enrol and evidence Apple devices with Jamf and Windows devices with Intune, so the list is complete.
Scenario 3
Updates that fix critical or high-risk vulnerabilities must be installed within 14 days of release, and unsupported software must go.
What you can doWe set update deadlines in Jamf and Intune and report devices that fall behind.
Scenario 4
The requirements expect separate accounts for administrative work.
What you can doWe remove admin rights from everyday accounts, set up separate admin accounts, and protect them with MFA.
Both cover the same five controls: firewalls, secure configuration, security update management, user access control and malware protection.
| Area | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it is assessed | Cyber EssentialsA self-assessment question set, signed off by a board member or equivalent and marked by an assessor. | Cyber Essentials PlusThe same self-assessment, plus hands-on technical testing of your systems by an assessor. |
| What it proves | Cyber EssentialsThat you say the controls are in place, and an assessor accepts your answers. | Cyber Essentials PlusThat the controls have been tested and work in practice. NCSC describes it as higher assurance. |
| Timing | Cyber EssentialsRenewed every 12 months. | Cyber Essentials PlusCompleted within 3 months of your Cyber Essentials certificate, then renewed every 12 months. |
From gap analysis to certificate, then a year of staying compliant.
Readiness review
We check your devices, cloud services and network against the current requirements, and agree your scope with you.
Book a readiness reviewFix the gaps
We fix the gaps across Mac, Windows, mobile and Microsoft 365, with baselines through Jamf and Intune, and Microsoft Defender and Jamf Protect.
With our partner
Our certification partner, which is licensed by IASME, runs the assessment, with us alongside you.
All year
Controls monitored all year, so renewal is straightforward.
Under PPN 014, central government buyers ask for Cyber Essentials or Plus on certain contracts, such as those handling personal data, and suppliers renew it every year of the contract. PPN 09/23 covers procurements started before 24 February 2025.
NCSC says a growing number of organisations require suppliers to be certified to bid for work.
UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, including incident response support.
We hold Cyber Essentials Plus ourselves, so we have been through the same questions and testing. For how we price ongoing support, see pricing.
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
Cyber Essentials is a verified self-assessment of five technical controls. Cyber Essentials Plus covers the same controls and adds hands-on technical testing of your systems by an assessor. Many public sector and larger clients require Plus.
Version 3.3 of the requirements took effect on 27 April 2026. Multi-factor authentication is now mandatory on every cloud service that offers it, and missing it is an automatic fail. Cloud services can no longer be excluded from scope.
Yes. Every device that accesses organisational data is in scope, including Macs, iPhones, iPads and personal devices. Phones used only for calls, texts or an MFA app are out of scope.
Certificates are issued through a certification body licensed by IASME, the NCSC’s delivery partner. We work with one as our certification partner. We get your devices, accounts and network ready and fix the gaps first, then take you through the assessment with them, so nothing in it comes as a surprise.
Twelve months. Cyber Essentials Plus must be completed within three months of your Cyber Essentials certificate, and both are renewed each year. Government contracts that ask for it under PPN 014 expect the certificate to be renewed every year of the contract, so plan each renewal well before the current one runs out.
Yes. Postremo IT holds Cyber Essentials and Cyber Essentials Plus, so we have been through the same assessment we prepare you for. We apply the five controls to our own Macs, PCs, phones and Microsoft 365: firewalls, secure configuration, security update management, user access control and malware protection.
Tell us about your devices, cloud services and any contract deadline. We will show you where you stand and what it takes to pass.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai
Your brief: