Frequently Asked Questions

• Is Cyber Essentials required to work with UK government?

  Not always, but many UK government contracts now require suppliers to hold Cyber Essentials certification. If your business handles certain government data, operates within the public-sector supply chain, or bids for government contracts, Cyber Essentials may be mandatory. Even when it is not required, certification demonstrates that your organisation takes cyber security seriously and follows recognised security best practices.

• Can you fail Cyber Essentials automatically based on certain answers?

  Yes. Certain responses within the Cyber Essentials assessment can result in an automatic failure if they indicate that the required security controls are not in place. The certification is based on five core security areas: firewalls, secure configuration, access control, malware protection, and software updates. If your organisation does not meet the required standards in these areas, you may need to address the issues before resubmitting. Our team can help identify and resolve potential problem areas before submission, improving your chances of a successful first attempt.

  
  

• Is the Cyber Essentials questionnaire just Yes/No, or does it require detailed responses?

  The Cyber Essentials questionnaire is primarily composed of structured questions that require more than simple yes-or-no answers. You will need to provide information about your organisation's user devices, software, security controls, user access, and working practices. The assessment is designed to verify that appropriate cyber security measures are in place, so accurate and detailed responses are important. Our team can help you understand the questions, gather the required information, and make sure your submission is completed correctly.

• How long does it take to get Cyber Essentials certification?

  The time required to achieve Cyber Essentials certification depends on your organisation's current security posture and how quickly any identified gaps can be addressed. Businesses that already have the required controls in place can often complete the process within a few days, while others may need several weeks to implement improvements before submitting. With the right preparation and support, the certification process can be completed efficiently and with minimal disruption to day-to-day operations.

• How often do you need to renew Cyber Essentials certification?

  Cyber Essentials certification must be renewed every 12 months. Annual renewal ensures your organisation continues to meet the required security standards and maintains protection against evolving cyber criminals. Regular recertification also demonstrates to customers, suppliers, and stakeholders that cyber security remains an ongoing priority for your business and that your IT infrastructure is well maintained and secure.

• What is the pass mark for Cyber Essentials?

  There is no published percentage pass mark for Cyber Essentials. Instead, certification is awarded when your organisation demonstrates that it meets all required security controls across the five areas assessed. If any critical requirements are not met, the assessment may fail, and you will need to address the issues before resubmitting. Working with an experienced Cyber Essentials partner can help ensure you are properly prepared before submission.

• Can you see the Cyber Essentials questions before applying?

  Yes. The Cyber Essentials question set is publicly available, allowing businesses to review the CE requirements before starting the certification process. Understanding how the questions apply to your organisation and providing accurate responses can still be tricky, particularly if your IT setup is complex. Reviewing the assessment beforehand can help you identify potential gaps and prepare for a smoother process.

• What is the difference between Cyber Essentials and Cyber Essentials Plus?

  Cyber Essentials and Cyber Essentials Plus are both government-backed cyber security certifications, but they differ in how your security controls are assessed.

  Cyber Essentials is a self-assessment certification. Your organisation completes a questionnaire to demonstrate that the required security controls are in place and operating effectively.

  Cyber Essentials Plus includes everything covered by Cyber Essentials, but also requires an independent technical audit. Security controls are tested by a qualified assessor to verify they are working as intended in a real-world environment.

  Cyber Essentials is often a practical starting point for businesses looking to strengthen their cyber security, while Cyber Essentials Plus provides a higher level of assurance for customers, suppliers, insurers, and stakeholders.

• Who needs Cyber Essentials certification?

  Cyber Essentials certification is suitable for organisations of all sizes that want to improve their cyber security and demonstrate that they take protecting data seriously. It is particularly relevant for businesses that handle sensitive data, work with public sector organisations, bid for government contracts, or need to meet customer and supply chain security requirements.

  For many SMEs, Cyber Essentials provides a practical and affordable way to reduce cyber risk, strengthen security controls, and build trust with clients, partners, and stakeholders.

• What happens if you fail Cyber Essentials?

  If you fail the Cyber Essentials assessment, you will not receive certification until the identified issues have been resolved. The assessment feedback will highlight the areas that do not meet the required standard, giving you the opportunity to make improvements and resubmit. Failing does not prevent you from becoming certified; it simply means certain security controls need to be strengthened before certification can be awarded. With the right guidance and remediation, most businesses can successfully achieve certification after addressing the required actions.