Cyber Essentials is the Government-backed certification scheme for basic cyber security. It describes itself as the minimum standard the Government recommends for organisations of all sizes.
What it doesn’t cover
The scheme’s requirements say:
So you could hold a Cyber Essentials certificate and still have customer data open to anyone through an app you built. The certificate doesn’t mean anyone has looked.
What it does cover
It covers five controls: firewalls, secure configuration, security updates, user access control and malware protection. Several of them go straight to the common problems of a home-grown system:
- You must control your accounts, including third-party accounts, and use unique credentials. Cloud services can’t be excluded.
- Authentication to cloud services must always use multi-factor authentication.
- You must remove accounts when they’re no longer needed, such as when someone leaves.
- Administrative work should use separate accounts.
So working towards it pushes you in the right direction on who holds the keys, even though the app’s own code isn’t examined.
Why now is a good time
The scheme normally costs between £320 and £600 plus VAT, according to the number of employees. In November 2026, the Government announced a 75% discount that could bring it down to between £80 and £125 plus VAT.
According to the scheme’s delivery partner, IASME, it’s for UK-based micro businesses and SMEs that haven’t held Cyber Essentials in the last four years, subject to eligibility and funding, and you must register and buy by 31 March 2027. Check the current terms before relying on this.
UK organisations with a turnover under £20 million that certify their whole organisation are also automatically entitled to cyber liability insurance arranged through IASME, according to the NCSC. Read what it covers.
How the two fit together
| Cyber Essentials | An app audit | |
|---|---|---|
| Looks at | Your organisation’s IT basics | Your home-grown system, and how it fits together |
| Your custom app | Out of scope | The whole point |
| Gives you | A recognised certificate | A report on your actual risks, and what to fix |
| Often asked for by | Bigger customers and public sector buyers | You, once you depend on the system |
We’d suggest you do both, if your app matters and you can get the discount. They don’t replace each other. VibeTend doesn’t issue Cyber Essentials certificates, and only licensed certification bodies can.
Questions
Will an audit help us pass Cyber Essentials?
It can help with the parts about accounts and access, since it lists all your logins and who controls them. The certification itself is a separate process, through a certification body.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
