Cyber Essentials Certification UK — CE & CE Plus, fully managed

Cyber Essentials is a UK government-backed cybersecurity certification scheme administered by IASME on behalf of the National Cyber Security Centre (NCSC). It certifies that an organisation has the five technical controls in place that would block the vast majority of common internet-borne attacks: a properly configured firewall, secure device configuration, user access control, malware protection and security update management.

Cyber Essentials is a self-assessment questionnaire validated by IASME. Cyber Essentials Plus is the same five technical controls — but verified by an independent IASME-licensed assessor through an external vulnerability scan, an internal authenticated scan of a sample of every device type, and email/web malware tests. Plus is required for many UK government and MoD contracts; basic Cyber Essentials is often the baseline.

On the Connection Technologies managed plan, Cyber Essentials starts at £103/month (£1,025/year ex VAT) for 1–9 users and includes the IASME submission and certification fee, our compliance agent on every device, third-party patching, security awareness training and policy templates. Cyber Essentials Plus starts at £272/month (£2,716/year ex VAT) and includes everything in Cyber Essentials plus the independent technical audit. All prices are ex VAT.

On a managed plan, basic Cyber Essentials typically takes 2–4 weeks from kick-off — most of that is our agent reaching every device and remediating any technical gaps automatically. Cyber Essentials Plus takes 4–8 weeks because the independent audit must be booked within 3 months of basic Cyber Essentials being issued, and the assessor needs roughly 3 weeks of lead time.

For most UK SMEs the basic Cyber Essentials certificate is enough — it covers procurement requirements for many private-sector contracts, qualifies you for the free £25,000 IASME cyber-liability insurance and gives you the credibility badge for your website. Cyber Essentials Plus is required if you handle MoD contracts, sensitive government data, or if your supply chain explicitly mandates it (large enterprises and the NHS increasingly do). When in doubt, ask the contract owner — most procurement portals state which level they require.

The five technical controls are: (1) Firewalls — every internet-facing device must have a properly configured firewall; (2) Secure configuration — devices and software must be configured to reduce vulnerabilities (no default passwords, unused software removed, etc.); (3) User access control — user accounts assigned only to authorised individuals with the minimum access needed, with multi-factor authentication on cloud services; (4) Malware protection — anti-malware software, application allow-listing or sandboxing on every endpoint; (5) Security update management — operating systems and applications kept patched and within their vendor-supported lifetime. Our agent enforces all five automatically.

The Complete Bundle includes: Cyber Essentials self-assessment, Cyber Essentials Plus audit by an IASME-licensed assessor, our Active Protect agent on up to 5 devices per user (Windows, macOS, iOS, Android), 3rd-party app patching for Windows and Mac, 70+ module security-awareness training (Learn) with phishing simulation, the Privacy Toolbox of GDPR templates, and our Smart Policies template manager. Pricing is published on this page (ex VAT, UK only).

Yes — and this is one of the biggest changes in the current Cyber Essentials standard. Any device used by an employee to access organisational data or services is in scope, including personal phones used for work email. You either need to enrol BYOD devices into management (so the controls can be enforced) or remove them from scope entirely (e.g. through a hardened bring-your-own-device policy that blocks data access from unmanaged devices). Our managed service handles the enrolment side via mobile device management.

We install a lightweight compliance agent on every in-scope device. The agent continuously scans against the Cyber Essentials technical controls, automatically pushes the fixes that can be remediated remotely (firewall configuration, secure-config baselines, app patching, MFA enforcement on cloud services), surfaces a compliance score per device, and produces the evidence pack that gets submitted to IASME. You answer business-context questions; we handle the technical evidence and renewal cycle.

Yes — when you certify through Connection Technologies (an IASME-aligned partner), eligible UK organisations with annual turnover under £20 million automatically receive £25,000 of free cyber-liability insurance with their Cyber Essentials certificate at no extra cost. The cover is renewed annually with your certification.

Cyber Essentials and Cyber Essentials Plus must be renewed every 12 months from the certification issue date to remain valid. On our managed plan, renewal is built into the subscription — our agent keeps you continuously compliant between certifications, so renewal is largely a paperwork exercise rather than a re-implementation project.