Cyber Essentials in 2026: what the current requirements mean for a 20-person business.

Cyber · 7 min · written 30 October 2026 · by the IT-360 team · sources at the end

What it is

Cyber Essentials is the UK government-backed scheme run by the National Cyber Security Centre through IASME. It covers five controls: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a self-assessment questionnaire checked by an assessor. For Cyber Essentials Plus, an assessor tests a sample of your devices and your cloud accounts to prove the answers are true. That is still how Cyber Essentials in 2026 works.

Why it matters more than it used to

Cyber Essentials in 2026 matters more because many insurers now ask for it at renewal, and public-sector and larger private contracts increasingly require it from suppliers. The scheme also sets the baseline the government's free cyber insurance for certified small businesses is built on. Beyond the paperwork, the five controls stop the large majority of the opportunistic attacks a small business actually sees.

The five controls, in plain terms

• Firewalls: every internet connection and every laptop has one turned on, with the default password changed.
• Secure configuration: no unused accounts or software, no default passwords, auto-run turned off, locked screens.
• User access control: everyone has their own account, admin rights are separate and rare, and every cloud service has multi-factor authentication.
• Malware protection: supported anti-malware on every device, or an allow-list of approved apps.
• Security updates: every operating system and application is supported by its maker and high-severity patches are applied within 14 days.

Where a 20-person business usually fails

Three places. Personal phones that read work email without being in scope or managed. A couple of machines still on an operating system that is out of support. And one cloud service, often the accounts package or the shared mailbox, without multi-factor authentication. None of these is expensive to fix. They just need finding first, which is what the readiness review on the Cyber Essentials page does.

A realistic timeline

Week one: scope the business and list every device and cloud service. Weeks two to four: fix what the review found, usually MFA, patching and retiring old machines. Week five: submit the questionnaire. Plus, if you want it, is an assessor visit in the following weeks. Certification lasts a year and the renewal is quicker because the controls are already in place. For Cyber Essentials in 2026, five weeks from start to certificate is realistic for most 20-person businesses.

Further reading on Insights: Windows 10: the last machines.

Sources

• National Cyber Security Centre: Cyber Essentials scheme overview and requirements for IT infrastructure.
• IASME: the current Cyber Essentials question set and the Plus test specification.