Cyber Essentials Certification for UK Businesses

Cyber Essentials is a UK government-backed certification that shows your business has the core technical controls in place to defend against the most common cyberattacks. It covers five areas: firewalls, secure configuration, access control and multi-factor authentication, malware protection, and keeping software updated. It is widely recognised, increasingly required to win contracts, and a practical baseline that stops the majority of everyday threats. HGC helps you achieve it and, just as importantly, keeps you compliant with it all year.

Cyber Essentials is a self-assessment: you complete a verified questionnaire confirming your controls are in place, and it is a faster route to certification. Cyber Essentials Plus covers the same five controls but adds an independent, hands-on technical audit where an assessor checks your systems directly, so it carries more assurance and takes a little longer. CE Plus is often the level required by larger contracts and by defence and NHS-adjacent supply chains. Not sure which you need? That is exactly what the readiness call is for.

The honest answer is that it depends on the size of your organisation and the state of your systems today, so we scope it per business rather than quote a headline figure. There is a certification assessment fee set by IASME that is tiered by organisation size, and then there is any remediation work needed to get your controls into the passing state. Our model is built around predictable, ongoing cost with no surprise remediation bills: after a short readiness call we tell you exactly what is needed before you commit to anything, so you never get a nasty invoice after the fact.

Increasingly, yes. Under the government's procurement rules (PPN 014), Cyber Essentials is required on many public-sector contracts, and that requirement cascades down supply chains to subcontractors. Ministry of Defence suppliers face Defence Cyber Certification expectations that include it, NHS-data suppliers face related assurance requirements, and many private-sector buyers now ask for it too. If you bid for work, there is a good chance a customer will ask for your certificate, and without it you can be ruled out before you start.

The scheme's v3.3 requirements took effect on 27 April 2026. The headline changes are that multi-factor authentication is now mandatory across all your cloud services, cloud services can no longer be left out of scope, and scoping rules are tighter overall. In practice this means certification depends more than ever on how your systems are set up and kept set up, and many businesses that passed previously will need work, particularly around MFA, to pass their next renewal. Keeping those controls current continuously is exactly what we do.

No, and we will always be straight with you about that. HGC is not the certification body. What we do is prepare, harden and evidence your environment so you meet the standard, and then your assessment and certificate are issued by an IASME-accredited body through our partner platform, CyberSmart. You get proper, accredited certification, managed end to end by your UK team. We are the people who get you there and keep you there; the accredited body issues the certificate.

It depends on the state of your systems today and which level you need, so we will not put a fixed number on it before we understand your setup, and we will be straight with you about your timeline once we do. As a guide, Cyber Essentials is a self-assessment and is the faster route, while Cyber Essentials Plus involves an independent technical audit and takes longer to arrange. Tell us your deadline on the readiness call and we will tell you honestly whether we can hit it, and the call surfaces any gaps first, so you know what is needed before you spend anything.

This is where we are different from a one-off certifier. A certificate is a snapshot of one day, and your real-world security drifts the moment a device is set up wrong or a patch is missed. We keep the five controls in the passing state continuously through the CyberSmart platform and the team that runs your IT, so renewal is a formality rather than a scramble, your insurer and your customers keep getting the answer they expect, and the certificate you paid for still holds up all year. Certified once, compliant all year.

We work across UK sectors, with particular focus on professional services (legal, accountancy, consultancy, architecture and engineering), finance and accountancy, healthcare-adjacent organisations, and the defence and engineering supply chain, where MOD requirements are a live driver. These are the sectors where certification is most often demanded by contracts, regulators and insurers, and where "done for you and kept current" matters most. If you are not sure whether it applies to your business, the readiness call will tell you.