Cyber Essentials certification

Cyber Essentials is a UK Government-backed certification scheme that demonstrates an organisation has basic cyber security controls in place. It covers five technical areas: boundary firewalls, secure configuration, user access control, malware protection, and patch management.

Any organisation that supplies the UK Government must hold Cyber Essentials certification. It is also increasingly required by local authorities, housing associations, NHS trusts, and large private sector businesses as a condition of supplier contracts. Cyber insurance policies increasingly reference it.

Cyber Essentials is a self-assessed certification. The applicant completes a questionnaire confirming their controls meet the required standard, which is then verified by a certifying body.

Cyber Essentials Plus includes everything in Cyber Essentials but adds an independent technical audit of the organisation’s systems by an accredited assessor. Cyber Essentials Plus provides stronger assurance and is required for some higher-value government contracts and certain sectors including defence supply chain.

With Network Fish managing the process, most London SMEs achieve Cyber Essentials certification within two to four weeks of the initial gap assessment. The timeline depends on how many of the five technical controls require remediation before submission.

Cyber Essentials Plus takes three to six weeks due to the additional independent technical audit. Both certifications must be renewed annually.

For Network Fish managed support clients, Cyber Essentials readiness is included as part of your contract at no extra charge. This covers the gap analysis against the five CE technical controls, hands-on remediation guidance, and support through the certification process end-to-end. The only additional cost is the certifying body fee — approximately £300 for Cyber Essentials — payable directly to the certifying body. Annual renewal is available from £300 + VAT per year.

For businesses not on a managed support contract, Network Fish charges from £400 + VAT for a standalone Cyber Essentials gap assessment, and from £800 + VAT for full assisted certification including remediation guidance, for organisations with up to ten users. Cyber Essentials Plus starts from £1,200 + VAT. Certifying body fees for CE Plus are approximately £400 to £500, payable directly to the certifying body.

Yes. Many UK cyber insurance providers offer reduced premiums to organisations that hold valid Cyber Essentials certification, because certification demonstrates that baseline security controls are in place. The reduction varies by insurer and policy, but businesses are encouraged to provide their certificate to their broker when renewing or taking out a cyber insurance policy.

Network Fish can provide a Cyber Insurance Readiness Report as an optional add-on that addresses standard insurer technical questionnaires.

Yes. Cyber Essentials certification is valid for twelve months and must be renewed annually. Network Fish offers an annual renewal service that includes a pre-renewal gap check, any remediation work required, questionnaire preparation, and submission management. Clients on a Complete Care support contract receive an annual Cyber Essentials gap check as part of their package.

A gap assessment reviews an organisation’s current IT environment against the five Cyber Essentials controls and produces a written report — RAG-rated Red, Amber, Green per control — identifying what needs to be fixed before the organisation can be certified. It does not result in a certificate.

Full assisted certification includes the gap assessment, remediation of identified issues, preparation and submission of the certification questionnaire, and liaison with the certifying body through to the issue of the certificate.