Rhys MorganTL;DR: Cyber Essentials Plus (CE+) is the UK government's independently assessed cybersecurity certification, mandatory for central government suppliers whose work involves handling personal data or providing technical products and services. The National Cyber Security Centre (NCSC) updated the scheme's technical baseline in 2025, with the new requirements applying to all assessments from early 2026. Key changes include stricter multi-factor authentication (MFA) rules covering all internet-facing user accounts, broader cloud service scope, mandatory firmware patching, and initial expectations around supply chain security. For any organisation bidding on public sector contracts — particularly with the Ministry of Defence (MoD), NHS, or Cabinet Office — treating these updates as a 2026 compliance deadline, rather than a future concern, is the only sound strategy.
What Cyber Essentials Plus Is — and How It Differs from the Basic Certification
Cyber Essentials is a UK government-backed cybersecurity scheme designed to help organisations protect themselves against the most common categories of cyber attack. Introduced by the NCSC in 2014 and administered by the IASME Consortium under licence, the scheme operates at two distinct levels.
The first level, Cyber Essentials (CE), is a self-assessment certification. An organisation completes a structured online questionnaire attesting to its compliance with five core technical controls and, if successful, receives a certificate valid for 12 months. It is well suited to smaller organisations beginning their cybersecurity journey and to lower-risk contracts.
Cyber Essentials Plus (CE+) is the independently verified tier. Rather than relying on self-attestation, CE+ requires a qualified assessor from an IASME-accredited certification body to test the organisation's actual systems. The assessor conducts technical verification that includes vulnerability scanning, device configuration review, and user account auditing — confirming what is actually in place rather than what has been declared.
The Five Technical Control Areas Covered by the Scheme
Both levels of the scheme address the same five control domains:
- Firewalls — all internet-connected devices must be protected by correctly configured boundary and device-level firewalls
- Secure configuration — default settings removed, unnecessary services and software disabled on all in-scope devices
- User access control — accounts restricted to the minimum permissions required for each role, with no sharing of administrative credentials
- Malware protection — anti-malware software deployed, active, and automatically updating on all in-scope devices
- Patch management (software and firmware updates) — all software and firmware patched within 14 days of a critical or high-severity update being published
Why the 2025–2026 Update Raises the Bar for Government Suppliers
The NCSC does not treat Cyber Essentials Plus as a static baseline. The scheme received its most substantial overhaul in April 2023 — the "Willow" update — which brought cloud services, home-worker devices, and firmware explicitly into scope for the first time. The 2025 technical revision, effective for all assessments from early 2026, builds on that foundation with changes that reflect shifts in how UK organisations work and how attackers operate.
Multi-factor authentication (MFA) is the area with the greatest practical impact. From 2026, MFA is required for all accounts with internet-facing access — not only administrator accounts. This includes user accounts accessing cloud-hosted services such as Microsoft 365, Google Workspace, or any Software-as-a-Service (SaaS) application where authentication is possible over the internet. Previous exemptions for shared or legacy accounts have been narrowed significantly.
Cloud service scope has been widened further. Organisations must now inventory and assess every cloud service in operational use, including SaaS applications adopted informally by employees. If a cloud service can access, store, or process data within CE+ scope, it must be configured and controlled to meet the scheme's requirements.
Supply chain expectations represent a new dimension. The 2026 scheme stops short of requiring organisations to certify their sub-contractors, but assessors will expect evidence that key third-party suppliers have been reviewed for cybersecurity posture and that contractual data security expectations are documented.
Alongside these scheme changes, the broader UK regulatory environment is tightening in parallel. Businesses trading with the European Union face overlapping obligations under the NIS2 Directive compliance framework, which shares several technical control areas with CE+ and demands similarly documented evidence of compliance.
What the 2026 Technical Assessment Tests in Practice
The CE+ audit is practical, not theoretical. An IASME-accredited assessor tests whether the five control areas are genuinely implemented on in-scope systems, not merely documented. Understanding what each control area looks like under active testing is essential for organisations preparing their environments.
Firewalls: The assessor verifies that boundary and device-level firewalls block unauthorised inbound connections. Default administrative credentials must have been changed on all networking equipment, and services not required for business operations must be disabled.
Secure configuration: All in-scope devices — employee laptops, servers, and cloud-hosted virtual machines — must have been hardened. Assessors look for a systematic approach: unnecessary applications and services removed, automatic screen lock enabled, and no use of operating systems past their vendor-published end-of-life date.
User access control and MFA: Under the 2026 scheme, assessors verify MFA on every account that can authenticate to in-scope systems over the internet. Password policies must meet NCSC guidance: a minimum length of 12 characters for accounts without MFA, or 8 characters where MFA is enabled. Accounts unused for more than three months must be disabled or removed.
Malware protection: Anti-malware software must be installed, active, and automatically updating on all in-scope devices. From 2025, evidence of content-based scanning — not only signature-based detection — is expected for higher-risk device categories.
Patch management — including firmware: All software and firmware on in-scope devices must be patched within 14 days of a critical or high-severity update being released by the vendor. The 2026 scheme makes explicit that this covers firmware on routers, firewalls, managed switches, and internet-connected devices — not only operating systems and business applications.
Government Contract Mandates: Where CE+ Is Now Non-Negotiable
The legal and procurement framework for Cyber Essentials Plus in UK government contracting is anchored in Cabinet Office Procurement Policy Note (PPN) 09/14, issued in October 2014. This note requires all central government contracts involving the handling of personal information, provision of technical products or services, or access to government networks to be held only by suppliers with a valid Cyber Essentials certificate at a minimum — and Cyber Essentials Plus where the contract involves sensitive data or critical services.
In practice, PPN 09/14 is applied more broadly than its minimum thresholds suggest. Most government departments now specify CE+ as a standard pre-qualification requirement for IT, digital, and data contracts, regardless of sensitivity classification.
The Ministry of Defence (MoD) extends these requirements across its entire defence supply chain through the Defence Cyber Protection Partnership (DCPP). For any contract within the MoD supply chain, CE+ is effectively mandatory regardless of contract value or tier. Suppliers found to have let their CE+ certificate lapse risk removal from approved supplier registers.
NHS England and NHS Digital have adopted equivalent requirements for technology and data suppliers across primary care, hospital trusts, and NHS supply chain partners. Healthcare data is classified as special category personal data under the UK General Data Protection Regulation (UK GDPR), making CE+ a practical prerequisite for NHS technology contracts.
The UK's heightened focus on defence sector cybersecurity — driven in part by NATO's push for member states to strengthen their defence industrial cyber posture — means that expectations on UK defence suppliers are rising faster than the baseline PPN timelines alone would suggest.
Local government procurement is following the same trajectory. While there is no single statutory mandate for local authorities, most UK council technology procurement now includes CE+ as a standard evaluation criterion.
A Six-Step Certification Roadmap for 2026
Achieving Cyber Essentials Plus under the 2026 requirements follows a predictable sequence. Organisations that have planned ahead consistently complete the process in six to ten weeks. Those that begin preparation only when a contract is at risk typically face longer remediation timelines and missed bid deadlines.
Steps 1–3: Prepare Your Environment
Step 1 — Define your scope. Identify every device, user account, and cloud service that falls within CE+ scope. In-scope assets are those that can access the internet, connect to in-scope networks, or process data covered by the contract. Home-worker devices connecting remotely are included. Personal devices used to access work systems under a bring-your-own-device (BYOD) policy are also in scope if they access corporate data.
Step 2 — Run a gap analysis against the 2026 controls. The IASME self-assessment tool provides a structured baseline check against current scheme requirements. For the 2026 update, priority areas are MFA coverage across all cloud accounts, a complete inventory of SaaS services in use, and firmware update status on all networking equipment.
Step 3 — Remediate identified gaps. The most common remediation tasks found in 2026 assessments are: enabling MFA on all Microsoft 365 or Google Workspace accounts, applying outstanding firmware updates on routers and network switches, and disabling accounts that have been inactive for more than three months.
Steps 4–6: Assess, Certify, and Sustain
Step 4 — Select an IASME-accredited certification body. Only bodies accredited by IASME on behalf of the NCSC can issue CE+ certificates. The IASME website maintains an up-to-date public register. For SMEs, assessment fees typically range from £1,000 to £3,000. Organisations with complex network environments should budget up to £5,000. Requesting quotes from at least two providers before committing is advisable.
Step 5 — Undergo the independent technical assessment. The assessor conducts remote technical testing of in-scope systems: external and internal vulnerability scanning, configuration review of sample devices, and verification of account and MFA settings. Assessments for most SMEs take one to three days.
Step 6 — Certify and build renewal into your contract calendar. CE+ certificates are valid for 12 months. A lapsed certificate constitutes a compliance breach under standard government contract terms. Build your renewal date into bid management and contract review processes — do not leave it to individual staff memory.
À retenir: Organisations that fail their initial CE+ assessment most commonly do so on MFA coverage and firmware patching — two areas that require systematic infrastructure changes, not quick fixes. Four to eight weeks of remediation time after a first failed attempt is typical. Start at least three months before your target certification date.
What Happens When Certification Lapses or Is Refused
The consequences of missing or losing Cyber Essentials Plus certification are immediate in government procurement terms, even when the underlying cybersecurity risk to the organisation may be unchanged.
A concrete scenario illustrates the stakes: a Manchester-based IT managed service provider held a government contract for desktop support services across three central government sites. Its CE+ certificate expired in March 2026 — a renewal oversight during a period of staff change. The contract authority raised a compliance notice within four weeks of expiry and suspended the supplier's access to government systems pending re-certification. The reassessment and remediation process took six weeks, during which the organisation could not invoice for contracted services. The direct financial impact — in suspended invoices and emergency assessor fees — exceeded £45,000.
For organisations working in the MoD supply chain, the consequences can be more abrupt. Defence suppliers with lapsed CE+ certification may be removed from approved supplier registers without notice, with contract suspension a potential outcome under DCPP terms.
The UK's evolving digital infrastructure requirements — including heightened cybersecurity obligations for operators of critical IT systems — mean that the regulatory cost of non-compliance is rising beyond procurement exclusion alone. Data security incidents at suppliers without current CE+ certification draw significantly greater scrutiny from the Information Commissioner's Office (ICO) under UK GDPR.
Disclaimer: The information in this article is provided for general guidance only and does not constitute legal, regulatory, or compliance advice. Organisations should consult an IASME-accredited certification body or qualified cybersecurity professional for guidance specific to their contracts and circumstances.
Frequently Asked Questions
What is Cyber Essentials Plus, and who is required to hold it?
Cyber Essentials Plus (CE+) is an independently verified cybersecurity certification covering five technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. Central government suppliers handling personal data or providing technical products and services are required to hold it under Cabinet Office Procurement Policy Note 09/14. MoD suppliers face additional obligations under the Defence Cyber Protection Partnership (DCPP), and NHS technology suppliers face equivalent requirements under NHS Digital supplier standards.
How does the 2026 Cyber Essentials Plus update differ from earlier versions?
The 2026 update extends mandatory MFA requirements to all internet-facing user accounts — not only administrators. It expands cloud service scope to include SaaS applications used on any device, introduces explicit firmware patching requirements for networking equipment and internet-connected devices, and adds initial expectations around third-party supplier security review. The changes follow the 2023 Willow revision and reflect the NCSC's response to evolving attack patterns and the shift to distributed, cloud-heavy working environments.
How long does Cyber Essentials Plus certification take?
For organisations already meeting the five control areas, the CE+ process — from selecting a certification body to receiving a certificate — typically takes two to four weeks. Organisations requiring remediation before assessment should allow an additional four to eight weeks. CE+ certificates are valid for 12 months and require annual renewal to maintain compliance status.
How much does Cyber Essentials Plus certification cost in 2026?
Assessment fees are set by individual IASME-accredited certification bodies and vary by organisation size. For small and medium-sized enterprises (SMEs), fees typically range from £1,000 to £3,000. Larger organisations with complex network environments should budget up to £5,000 or more. The IASME Consortium maintains a public register of accredited certification bodies, and comparing quotes from two or three providers before committing is recommended.
