Protect, Cyber Essentials
Cyber Essentials, certified.
Cyber Essentials and Cyber Essentials Plus are the UK government-backed standard for cyber security. Fuse gets you ready, and your assessment is carried out by an independent, IASME-licensed Certification Body. One conversation, from the first scoping call to the certificate on your wall.
What it is
The minimum standard the UK government recommends for every organisation.
Cyber Essentials is overseen by the National Cyber Security Centre (NCSC) and delivered through IASME. It sets out five technical controls that, put in place properly, protect against the most common internet-based attacks: phishing, password guessing, malware and attackers exploiting software that has not been updated.
Certification proves those controls are in place. More and more clients, tenders and insurers ask for it before they will work with you, and central government requires it for contracts that involve handling personal information or providing certain ICT services.
The five controls
What you are assessed against.
Both levels of certification cover the same five technical controls, applied across the devices, networks and cloud services in scope.
Firewalls
Boundary firewalls and internet gateways set up to stop unauthorised access to your network and devices.
Secure configuration
Default passwords changed, unnecessary software and accounts removed, and devices locked down.
Security update management
Supported software only, with high-risk and critical updates applied within 14 days of release.
User access control
Accounts only for those who need them, admin rights kept separate, and multi-factor authentication on cloud services.
Malware protection
Anti-malware or application allow-listing to stop viruses, ransomware and other malicious software running.
Renewed every year
A certificate is valid for twelve months. We keep track of your renewal date and get you ready in good time.
Two levels
Cyber Essentials, or Cyber Essentials Plus.
The controls are the same. The difference is how they are checked, and so how much assurance the certificate gives the people who ask to see it.
Verified self-assessment
You complete the IASME question set online and a director signs it off. An independent assessor reviews and marks your answers, and the certificate is awarded on a compliant submission. The right starting point for most organisations.
- Online questionnaire through the IASME portal
- Marked by an independent assessor
- A round of clarification if anything needs another look
- Meets the requirement for many tenders and supply chains
- Free cyber liability insurance for eligible organisations
The same controls, technically tested
Built on Cyber Essentials, with a hands-on technical audit by the assessor so the controls are proven to work, not just declared. Carried out remotely, and completed within three months of your Cyber Essentials certificate.
- Everything in Cyber Essentials
- Vulnerability scanning of a sample of devices and your internet-facing systems
- Malware tests by email and web download
- Checks on patching, admin rights and multi-factor authentication
- Written report with any findings to fix before the certificate is issued
| At a glance | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it is checked | Self-assessment, independently marked | Self-assessment plus a technical audit |
| Delivered | Online | Remotely, by an accredited assessor |
| Assurance | Baseline | Higher, controls tested in practice |
| Prerequisite | None | Cyber Essentials, awarded within the last three months |
| Valid for | 12 months | 12 months |
| Typical requirement | Tenders, supply chains, insurers | Public sector, enterprise and higher-risk contracts |
How it works
From first call to certificate.
Fuse handles the preparation and stays your single point of contact throughout. An IASME-licensed Certification Body carries out the assessment and issues the certificate, keeping the decision fully independent.
Scope it
A short call to agree what is in scope: your devices, networks, cloud services, sites and remote workers, and which level you need.
Get ready
We check your setup against the requirements and close the gaps, from multi-factor authentication to patching and admin rights.
Assess
You submit the self-assessment for marking. For Plus, the assessor runs the technical audit remotely on an agreed sample of devices.
Certify & renew
Certificate issued and listed publicly. We keep the controls in place through the year and prompt your renewal before it lapses.
Why prepare first
The 2026 requirements leave less room for error.
The scheme was tightened for assessments started from April 2026. Multi-factor authentication must now be switched on for every cloud service that offers it, and high-risk or critical updates must be applied within 14 days. Miss either and the assessment fails automatically.
Cyber Essentials Plus is stricter too. Your answers are fixed once testing starts, patching has to hold up across the whole estate rather than just the sample, and a failed Plus audit can cost you your Cyber Essentials certificate as well. Nobody can guarantee a pass, and the assessment is charged whatever the outcome, which is exactly why getting ready properly matters.
Why it is worth it
Safer, insured, and eligible for more work.
Win government work
Central government departments, agencies and NHS bodies require Cyber Essentials or Plus for contracts that handle personal information or provide certain ICT services.
Free cyber insurance
UK organisations with turnover under £20m that certify their whole organisation can opt in to £25,000 of cyber liability cover, included with the certificate.
Prove it in the supply chain
Your certificate is publicly searchable, so clients and buyers can check it for themselves in seconds, saving time on due diligence.
Fewer successful attacks
The five controls are designed to stop the common, opportunistic attacks behind most incidents affecting UK businesses.
Insurer confidence
Many insurers ask about Cyber Essentials when quoting, and certified organisations make far fewer claims.
Know where you stand
Preparing for certification gives you a clear picture of your security, and a practical list of what to fix.
Independent assessment
We get you ready. An independent assessor certifies you.
Fuse works with an IASME-licensed Certification Body whose accredited assessors carry out your assessment and make the certification decision independently. That separation is what gives your certificate its credibility.
Fuse stays your single point of contact throughout, and you buy your certification through us. We scope the work, get you ready, book the assessment and support you through any findings, so you deal with one team you already know.
Who it's for
Built around who you are.
Bid, insure and grow
Hold the certificate your clients, tenders and insurers ask for, prepared by the team that runs your IT. Work with us directly, wherever you are based.
Certify your own operation
Property companies hold tenant and payment data too. Show investors, lenders and occupiers that your own business is secure.
More to offer occupiers
A certification service you can point tenants to, fully managed by Fuse, with no operational burden on you.
Questions
Cyber Essentials, answered.
How long does it take?
Once you are ready, a Cyber Essentials submission is usually marked within a couple of working days. Cyber Essentials Plus dates are normally offered within two weeks of booking, with the report following shortly after testing. The preparation beforehand depends on your starting point, and we will give you a realistic timeline at the scoping stage.
What does it cost?
Certification is priced on the size of your organisation, because that is what sets the IASME certification fee, not on how many devices or users you have. The price includes the certification fee, the assessment and the certificate. Any preparation work is quoted separately, so you know exactly what you are paying for. Talk to us for a quote.
Can you guarantee we will pass?
No, and nobody licensed under the scheme can. The certification decision rests entirely with the independent assessor, and the assessment is chargeable whatever the outcome. What we can do is make sure you are properly ready before you book, which is the best way to pass first time.
Fuse manages our IT. Is that a conflict?
No. That is the point of the arrangement. Fuse prepares you and an independent Certification Body assesses you, so the people marking your assessment are independent of the people who set up your systems.
What do we need for Cyber Essentials Plus?
A valid Cyber Essentials certificate awarded within the last three months, then on the day: the sampled devices switched on and connected, a standard (non-admin) user account on each, email and web access for the malware tests, remote access for the assessor, and a technical contact available throughout. We will run through all of it with you beforehand.
Do we have to certify the whole organisation?
Not necessarily, you can certify a defined part of the business if it is properly separated. To qualify for the free cyber liability insurance, though, the whole organisation must be certified. We will help you decide what makes sense at scoping.
Who issues the certificate?
Our certification partner, Layer 7, an IASME-licensed Certification Body. The certificate names Layer 7 and IASME and is listed on the public register of certified organisations. Fuse delivers certification in partnership with Layer 7 and arranges everything for you, so all you need to do is talk to us.
Let's talk
Get the certificate. Keep the door locked.
Tell us what you need to certify for and when, and we will scope it, get you ready and book your assessment.