Practical cyber security guidance
Cyber Essentials FAQ for small businesses
Cyber Essentials is a UK government-backed scheme built around five technical control areas. It gives organisations a practical baseline against common internet-based attacks and is increasingly requested by customers and supply chains.
Frequently asked questions
6 practical answers.
### What are the five Cyber Essentials technical controls?
The five control areas are firewalls, secure configuration, security update management, user access control and malware protection.
### What version of the requirements applies in 2026?
The current Requirements for IT Infrastructure version is v3.3, effective from 27 April 2026. Requirements can change, so always check the current official question set and infrastructure requirements before certification.
### Does Microsoft 365 count as part of Cyber Essentials scope?
Cloud services can be in scope and the current requirements should be used to establish the organisational boundary and what technology sits within it. Scope needs to be defined before answering the assessment.
### Does 39Security issue the Cyber Essentials certificate?
No. 39Security can help with readiness, remediation, evidence preparation and implementation. Certification is awarded through the Cyber Essentials scheme and an authorised Certification Body.
### Do we need to fix every gap before applying?
The certification requirements must be met for the agreed scope. A readiness review can identify likely gaps first so remediation can be completed before the assessment is submitted.
### Is Cyber Essentials the same as a full security programme?
No. It is an important baseline focused on common attacks. Businesses may still need additional controls such as monitored detection and response, backup and recovery, advanced email protection, incident response, supplier risk management and staff training.
Related guidance