Certify to Cyber Essentials and CE Plus
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme — owned by the National Cyber Security Centre (NCSC) and delivered by the IASME Consortium — designed to protect organizations against the most common internet-based cyber attacks. It is deliberately simple: the entire scheme rests on five technical controls, which makes it an excellent baseline and a frequent requirement for UK public-sector contracts.
The five technical controls
- Firewalls — boundary and host firewalls configured to block untrusted traffic.
- Secure configuration — remove or disable unnecessary functionality and change default credentials.
- User access control — least-privilege accounts, with multi-factor authentication required for cloud services.
- Malware protection — anti-malware, allow-listing, or sandboxing across in-scope devices.
- Security update management — keep software supported and patched within required windows.
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials is a verified self-assessment against the five controls. Cyber Essentials Plus assesses the same controls but adds a hands-on technical audit — vulnerability scans and tests of a sample of in-scope devices — for a higher level of assurance. NCSC and IASME update the technical requirements annually, so recent revisions have tightened expectations (for example, mandatory MFA for cloud services and stricter marking of critical controls).
How episki helps
episki implements the five Cyber Essentials controls as living controls with scoping for your devices, users, and cloud services, and keeps the evidence current for the annual recertification or the CE Plus audit. Because the controls map up to ISO 27001, NIST CSF, and SOC 2, Cyber Essentials becomes the first rung of a larger program rather than a dead end.
Cyber Essentials outcomes with episki
Why teams choose episki for Cyber Essentials
- Firewalls and secure configuration
- User access control with MFA
- Malware protection and update management
- Self-assessment questionnaire support
- Asset and device scoping
- Evidence ready for the CE Plus technical audit
- Crosswalk to ISO 27001 and NIST CSF
- Reuse evidence across SOC 2
- Government-recognized baseline
Cyber Essentials readiness inside episki
Plug episki into your stack and work directly from this checklist during the free trial.
- ✓ Scope definition (devices, users, cloud services)
- ✓ Firewalls and boundary controls
- ✓ Secure configuration and removal of defaults
- ✓ User access control with MFA on cloud services
- ✓ Malware protection across in-scope devices
- ✓ Security update management within required windows
