Cyber Essentials and the Cyber Security and Resilience Bill: is it enough?
No. Cyber Essentials is a useful baseline, but the Cyber Security and Resilience Bill (CSRB) doesn’t require it and a certificate won’t meet the Bill’s duties. It covers five technical controls, not governance, supply chain, monitoring or incident reporting. It can still help when customers ask for evidence.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Is Cyber Essentials required by the Bill?
No. The Cyber Security and Resilience Bill (CSRB) doesn't mention Cyber Essentials as a requirement in the text as brought from the Commons, and holding a certificate doesn't mean you meet the Bill's duties. It is still useful: it's a recognised baseline, and customers may ask for it.
What Cyber Essentials covers
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC) and delivered through IASME. It covers five technical controls:
- firewalls
- secure configuration
- security update management
- user access control
- malware protection
Cyber Essentials combines a self-assessment with an independent audit. Cyber Essentials Plus assesses the same controls and adds independent technical testing. Pricing for the standard level is tiered by organisation size and starts at £320 plus VAT, while Plus is quoted based on your network.
How it compares with what the Bill expects
| Area | Cyber Essentials | Regulated organisations under the Bill |
|---|---|---|
| Purpose | Baseline against common internet-based attacks | Appropriate and proportionate risk management |
| Legal status | Voluntary certification, though contracts may require it | Statutory duties, with fines |
| Board and risk governance | Not covered | Likely to be expected. See the Cyber Assessment Framework (CAF), A1 and A2 |
| Supply chain | Not covered as a control | A key concern, including critical supplier designation |
| Monitoring and detection | Not covered | Needed in practice to spot incidents and meet reporting deadlines |
| Incident reporting | Not covered | 24-hour and 72-hour notifications |
| Scope | The boundary you define for certification | Systems relied on to provide the regulated service |
The NCSC describes achieving all CAF outcomes as a level of security "some way beyond the bare minimum". Cyber Essentials overlaps with parts of Objective B of the CAF, such as secure configuration and access control, but it doesn't reach much of the rest.
Who should get it
If you're small and not directly regulated, this may be your most practical step. The Bill's digital and managed service duties exclude micro and small enterprises, but your customers may still want proof of basic security. See does the Bill apply to small businesses?
If you supply regulated organisations, expect it to come up. The government's Cyber Resilience Pledge asks signatories to use the Cyber Essentials Supplier Check Tool across their supply chains. You can read more in our post on the pledge.
If you're bidding for government work, the government says certification enables you to bid for contracts where financial or personal data is handled. Check the specific tender.
If you're regulated, treat it as a floor and not your compliance plan. It can be a useful supplier requirement, or an easy baseline for lower-risk parts of your organisation.
Finance sector firms
Financial firms sometimes ask if Cyber Essentials satisfies their regulators. Don't assume so. UK banks aren't a sector under Schedule 2 of the NIS Regulations 2018, and firms answer mainly to FCA and PRA rules, which go well beyond these five controls. It can still be a reasonable requirement for smaller suppliers. See FCA and PRA cyber requirements.
What the numbers say
- Government statistics record 61,430 certificates between July 2025 and June 2026: 46,245 at the standard level and 15,185 at Plus.
- The government states that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance. That shows an association, not proof that certification caused the difference, since more careful organisations may be more likely to certify.
How to get it to count for more
- Set the scope honestly. A narrow certificate that leaves out your main business systems will reassure nobody who reads it closely.
- Choose Plus where assurance matters, because it tests whether the controls work.
- Don't let it lapse. Treat it as an ongoing discipline, not a once-a-year project.
- Use it as a stepping stone. Add monitoring, incident response and supplier management, then move toward a CAF self-assessment.
- Tell customers what it covers. If a customer asks about the Bill, a certificate answers part of the question and not all of it.
Sources
Frequently asked questions
Not in the text as brought from the Commons. It remains a separate, voluntary certification scheme, although customers and some contracts can require it.
Both cover the same five controls and are independently verified. Plus adds independent technical testing to check the controls work in practice.
No. Cyber Essentials is a certification covering five technical controls. The Cyber Assessment Framework is a much broader outcome-based assessment that also covers governance, supply chain, detection and response.
It is often a practical step, especially where customers ask for evidence of security. Micro and small enterprises are excluded from the Bill’s digital and managed service duties, but contracts may still set requirements.