Cyber Essentials is usually the first security certificate a UK software company is asked for, and since 27 April 2026 the rules leave no room for the two shortcuts SaaS teams used to take. Version 3.3 of the requirements states that cloud services cannot be excluded from scope, and that authentication to cloud services must always use multi-factor authentication. For a company that runs on AWS, Google Workspace, GitHub and a dozen SaaS tools, that is most of the assessment.
This guide explains what Cyber Essentials is, when UK buyers expect it, what v3.3 changed, how the five controls map onto a typical SaaS stack, and what certification costs. It is written for founders and engineering leads at UK software and SaaS companies. It does not replace the official requirements document or advice from a certification body, and it does not cover the NHS Data Security and Protection Toolkit or ISO 27001 in depth.
What is Cyber Essentials?
Cyber Essentials is the UK government-backed baseline security certification, run by the NCSC with IASME. It confirms five controls: firewalls, secure configuration, security update management, user access control and malware protection. Basic certification is a verified self-assessment from £320 plus VAT; Cyber Essentials Plus adds independent technical testing of the same controls.
The NCSC describes it as protection against the most common internet-based attacks, the "digital equivalent of a thief trying your front door", and notes that a growing number of organisations require suppliers to be certified before they can bid (NCSC Cyber Essentials overview).
Does your software company need Cyber Essentials?
It is voluntary for most companies. It stops being optional when a customer requires it, and for UK software suppliers that happens early.
- Central government contracts. Cyber Essentials has been mandatory for central government contracts advertised after 1 October 2014 that involve handling personal information and providing certain ICT products and services (Procurement Policy Note 09/14).
- Enterprise and regulated buyers. Banks, insurers, health and care organisations and large corporates commonly include it in supplier security questionnaires.
- Supply chain programmes. The NCSC publishes a playbook encouraging large organisations to require Cyber Essentials across their suppliers.
- Insurance. UK organisations with turnover under £20 million that certify their whole organisation are entitled to free cyber liability insurance arranged by IASME, with a £25,000 total liability limit and a 24-hour incident helpline (NCSC help and resources).
Cyber Essentials, Cyber Essentials Plus, ISO 27001 or SOC 2?
| Standard | What it proves | How it is assessed | Who asks for it |
|---|---|---|---|
| Cyber Essentials | Five baseline technical controls are in place | Self-assessment questionnaire, signed off by a board member and marked by an assessor | UK public sector, UK SMEs and corporates |
| Cyber Essentials Plus | The same five controls work in practice | Independent technical audit and testing | Larger UK buyers, higher-risk contracts |
| ISO 27001 | A managed information security system covering people, process and technology | External certification audit | UK, EU and international enterprise buyers |
| SOC 2 | Controls over security and chosen trust criteria operated over time | CPA firm attestation report | US buyers and US-led procurement |
Cyber Essentials is the cheapest and fastest of the four and a sensible first step. It does not replace ISO 27001 or SOC 2 when an enterprise buyer asks for those. Our SOC 2 guide for SaaS startups covers when the US report becomes necessary.
What changed in Cyber Essentials v3.3?
The NCSC's Requirements for IT Infrastructure v3.3 applies to applications started from 27 April 2026. Applications started before that date could continue under v3.2, in effect since 28 April 2025. The "what's new" list in v3.3 is short (NCSC Requirements for IT Infrastructure v3.3):
- A definition of "cloud services" is provided.
- A definitive statement that cloud services cannot be excluded from scope.
- An updated definition of passwordless authentication that includes FIDO2, with FIDO2 authenticators treated as passkeys and as MFA.
- The Software Security Code of Practice is introduced in the software development section.
- Scope criteria no longer refer to "untrusted connections".
- The importance of backing up data is emphasised.
For SaaS companies the practical effect is simple: every cloud platform and SaaS tool that holds your organisation's data is assessed, and each one needs MFA switched on for every user.
How the five controls apply to a SaaS company
| Control | What it means in a SaaS stack | Where SaaS teams usually fail |
|---|---|---|
| Firewalls | Software firewalls on laptops; security groups and network rules on cloud servers; default-deny inbound | Open management ports on cloud instances left from early development |
| Secure configuration | Change default passwords, remove unused accounts and software, disable auto-run, lock devices with a PIN, password or biometric | Shared or default admin logins on cloud consoles and internal tools |
| Security update management | Supported, licensed software only; critical and high-risk updates (CVSS 7 or above) applied within 14 days; auto-update on where possible | An old operating system on one developer laptop, or a server image nobody patches |
| User access control | Account approval process, unique credentials, leavers removed, separate admin accounts, MFA wherever available and always for cloud services | Founders using admin accounts for daily work; MFA missing on one SaaS tool |
| Malware protection | Anti-malware on in-scope devices, or application allow-listing | Unmanaged personal devices used to read company email |
Scoping: what is in and out for a software company
Cloud services are always in
If your data or services are hosted on cloud services, they must be in scope. Responsibility for each control is shared with the provider depending on whether the service is IaaS, PaaS or SaaS, but you remain responsible for making sure every control is implemented. Your AWS, Azure or Google Cloud accounts, Microsoft 365 or Google Workspace, GitHub, and tools like your CRM and ticketing system all count.
Devices, including personal ones
User-owned devices that access organisational data or services are in scope, apart from devices used only for native calls, texts or MFA apps. Home and remote working devices used for your business are in scope by default.
Contractors and outsourced developers
Devices owned by a third-party contractor or managed service provider are out of scope. Accounts your organisation owns are in scope even when a third party uses them (v3.3, sections D(v) and D(vi)). So if an outsourced team, like the models compared in our London vs offshore vs nearshore guide, works in your GitHub organisation and your cloud accounts, those accounts must meet the access control requirements: MFA, least privilege and prompt removal when the engagement ends. You are still responsible for confirming that out-of-scope devices touching your services are configured correctly.
Your own product's code
Bespoke and custom components of web applications are out of scope for Cyber Essentials. The NCSC points software vendors to the Software Security Code of Practice, a voluntary set of 14 principles launched in May 2025. Certification says your company's IT is secured to a baseline. It says nothing about whether your application is free of vulnerabilities; that is what secure development and penetration testing are for, as covered in our web application security guide.
What does Cyber Essentials cost?
- Cyber Essentials certification: priced by organisation size, starting at £320 plus VAT.
- Cyber Essentials Plus: priced by the size and complexity of your network, quoted by a certification body.
- Internal effort: mostly time to inventory devices and accounts, enforce MFA, separate admin accounts, set patching rules and remove unsupported software.
- Tooling you may need: device management to enforce screen locks, updates and encryption on laptops and phones; endpoint protection if you do not already have it.
- Help: the NCSC offers a free readiness tool, a free question set download, and a free 30-minute consultation with an NCSC-assured Cyber Advisor for SMEs.
How to get Cyber Essentials certified
- Run the NCSC Readiness Tool to get a tailored action plan.
- Download the question set and read it alongside the v3.3 requirements so you know exactly what you will be asked.
- Set the scope. Certify the whole organisation if you can; it is simpler and is required for the free insurance.
- Build an inventory of devices, operating systems, cloud services and every account with admin rights.
- Turn on MFA for every cloud service and every user, then create separate admin accounts for administrative work.
- Fix patching and remove unsupported software. Enable automatic updates and apply critical and high-risk fixes within 14 days.
- Lock down third-party access. Review contractor and supplier accounts in your systems, apply least privilege and document removal on exit.
- Complete the assessment through IASME's self-led route or with a certification body, with sign-off from a board member or equivalent.
- Book Cyber Essentials Plus if buyers ask for it, and diarise renewal so the certificate never lapses mid-tender.
Frequently asked questions
How much does Cyber Essentials cost in 2026?
Basic Cyber Essentials certification starts at £320 plus VAT and is priced by organisation size. Cyber Essentials Plus is quoted by a certification body based on the size and complexity of your network. Your main cost is usually internal time to enforce MFA, patching and device controls, plus any device management tooling you do not already have.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both assess the same five technical controls. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds independent technical testing to check the controls work in practice, which gives buyers higher assurance. Many companies certify basic first and move to Plus when a contract requires it.
Does Cyber Essentials cover my SaaS application's code?
No. Bespoke and custom components of web applications are out of scope. Cyber Essentials covers your organisation's devices, networks, accounts and cloud services. For your product, use secure development practice, the Software Security Code of Practice and regular penetration testing.
Are outsourced developers in scope for Cyber Essentials?
Devices owned by third-party contractors are out of scope, but any accounts your organisation owns that contractors use, such as your GitHub organisation or cloud accounts, are in scope. Those accounts need MFA, appropriate privileges and removal when the engagement ends.
What changed in Cyber Essentials in April 2026?
Version 3.3 of the requirements applies to applications started from 27 April 2026. It defines cloud services, states they cannot be excluded from scope, updates passwordless authentication to include FIDO2 passkeys, introduces the Software Security Code of Practice, drops the "untrusted connections" scope criterion and emphasises backups.
Key takeaways
- Cyber Essentials certifies five baseline controls and starts at £320 plus VAT; Plus adds independent testing.
- Since 27 April 2026, v3.3 makes cloud services explicitly in scope and requires MFA for all cloud authentication.
- Contractor-owned devices are out of scope, but your accounts that contractors use are in.
- Your product's own code is out of scope; secure development and penetration testing cover it.
- UK organisations under £20 million turnover that certify the whole organisation get free cyber liability insurance through IASME.
Build software that passes the questionnaire
If a UK buyer has asked for Cyber Essentials and you are not sure your stack or your development supplier is ready, send us the security questionnaire. Our UK company, run from our London office at 2-7 Clerkenwell Green, EC1R 0DE, will review how your cloud accounts, repositories and supplier access are set up and give you a written list of gaps to close. If what you actually need is ISO 27001 or a penetration test, we will say that too. Our cloud engineering team handles the infrastructure side.