What is Cyber Essentials, and when do UK customers require it?

Quick answer

Cyber Essentials is the UK's government-backed cybersecurity certification: five technical control themes (firewalls, secure configuration, access control, malware protection, and security update management) that block the bulk of commodity attacks. It comes in two levels: Cyber Essentials (a verified self-assessment) and Cyber Essentials Plus (the same controls, independently tested). UK government contracts involving certain data require it, and UK enterprises increasingly expect it from suppliers.

The five control themes

Firewalls: boundary and host firewalls configured to block unauthenticated inbound access.
Secure configuration: default passwords gone, unnecessary services off, device locking enforced.
User access control: least privilege, unique accounts, MFA where available, and admin accounts separated from daily use.
Malware protection: anti-malware or application allow-listing on in-scope devices.
Security update management: supported software only, with high-severity patches applied within 14 days.

The 14-day patch rule is the requirement organizations most often fail: it's concrete, dated, and checked. Scope covers the devices and services that access organizational data, including cloud services and, notably, BYOD used for work.

When it becomes mandatory for you

UK public sector contracts: required for central government contracts involving handling of certain personal or sensitive data, and common in wider public procurement.
Supply chains: UK primes flow it down to suppliers, similar in mechanism to CMMC or NIS 2 flow-down.
Insurance and due diligence: some UK cyber insurance offers and enterprise questionnaires treat it as the baseline sanity check.

Where it sits in a bigger program

Cyber Essentials is deliberately narrow: technical hygiene, annually renewed, cheap and fast compared to ISO 27001. For companies with a real control program, the five themes are a subset of what continuous monitoring already verifies, so certification becomes an exercise in scoping and answering, not building; see running it on OptiTech.