Cyber Essentials is a UK government-backed certification scheme, developed by the NCSC, that helps businesses protect against common cyber threats. It is based on five technical controls and is the minimum recommended standard for UK organisations. Certification demonstrates that your business has the fundamental security measures in place to defend against the majority of internet-based attacks.

Any UK business that handles customer data, works with public sector clients, or operates within a supply chain that requires security assurance should consider Cyber Essentials certification. It is particularly valuable for SMEs that need to demonstrate their security credentials to clients or partners, and it is a mandatory requirement for certain government contracts.

Cyber Essentials is a verified self-assessment, you answer a detailed questionnaire, which is reviewed by an accredited assessor. Cyber Essentials Plus includes everything in the standard certification, plus an independent technical audit of your actual systems to verify the controls are working in practice. Plus provides a higher level of assurance and is increasingly required in higher-risk environments.

The timeline depends on your current security posture. If your controls are largely in place, certification can be achieved relatively quickly, sometimes within a few weeks. If significant gaps exist, more preparation will be needed. Ballards will assess your position from the outset and give you a realistic timeline before any work begins.

From 27 April 2026, version 3.3 of the Cyber Essentials requirements (known as 'Danzell') comes into effect. The most significant change is that multi-factor authentication (MFA) becomes mandatory across all cloud services that offer it, failure to have it enabled will result in an automatic fail. Cloud services are also formally included in scope and can no longer be excluded from assessments.

Yes. Cyber Essentials certification is valid for 12 months and must be renewed annually. Renewal follows the same assessment process and must be completed against the requirements in force at the time of renewal. If your renewal falls after 27 April 2026, you will be assessed against the updated v3.3 standard. Ballards supports ongoing annual renewal as part of our service.

The cost of the Cyber Essentials assessment itself is set by IASME and is tiered by organisation size, starting from £320 + VAT for the smallest organisations. Cyber Essentials Plus, which includes a technical audit, typically costs more depending on the size and complexity of your network. Ballards can provide a clear cost estimate for the full readiness and certification process.

A failed assessment isn't uncommon, and it isn't the end of the process. It simply means that one or more controls weren't in place at the time of assessment. Ballards will work with you to understand what needs to change, help you address the gaps, and support you in resubmitting. The goal is to get you certified, not just to complete an assessment.