Cyber security

Cyber Essentials is the UK's baseline security certificate, and some public contracts require it.

Cyber Essentials is a UK certification scheme that checks five basic technical controls. They are firewalls, secure configuration, security update management, user access control and malware protection. The NCSC, the UK's National Cyber Security Centre, developed the scheme. IASME runs certification for the NCSC, as its official delivery partner.

There are two levels. For Cyber Essentials, you complete a self-assessment, a board member or equivalent signs off the answers, and an assessor marks them. Cyber Essentials Plus checks the same five controls and adds independent technical testing of your systems. Prices start at £320 plus VAT and depend on your size.

You can apply through IASME yourself, or use a certification body that IASME licenses. That body can help you understand the questions. To see whether an organisation holds a current certificate, use IASME's certificate search.

UK central government departments, their agencies and NHS bodies ask for it on some contracts. An example is a contract where a supplier handles personal data about citizens or government staff. Instead of the certificate, a supplier can show the same controls another way. A supplier that holds the certificate renews it every year while the contract runs.

A UK government survey shows how common the certificate is, and how that is changing.

In the UK government's latest survey, 5 per cent of businesses said they held Cyber Essentials. That was up from 3 per cent the year before. Among large businesses, 35 per cent held it and 12 per cent held Cyber Essentials Plus. The survey was published on 30 April 2026.

More businesses have the controls than hold the certificate. In the same survey, 24 per cent had all five controls in place, and 17 per cent were aware of the scheme. The report says some businesses, mainly medium and large ones, may already meet the standard without the certificate.

A certificate is one way to show customers how you manage information security.

ISO/IEC 27001 is an international standard for an information security management system, the way an organisation manages risks to its information across people, policies and technology. A certification body audits your system and issues the certificate, but certification is a choice, and some organisations follow the standard without it.

The current edition is ISO/IEC 27001:2022, with one amendment from 2024. ISO writes the standard but does not certify anyone. An accredited certification body must not also offer consultancy on management systems, so help to prepare comes from a different firm. Accreditation is not compulsory, but it confirms independently that a body is competent.

In the UK, UKAS is the national body that accredits certification bodies for ISO/IEC 27001. UKAS describes its role as checking the checkers. You can confirm a UKAS accredited certificate on its free CertCheck database.

Holding ISO/IEC 27001 does not mean you meet Cyber Essentials. UK government guidance says an ISO 27001 scope does not usually include all five controls, and rarely tests them. So where a UK government contract asks for Cyber Essentials, ISO 27001 alone is usually not enough. Most businesses with it also need Cyber Essentials, or must show the same controls another way.

Customers ask suppliers for SOC 2 reports, and a report works differently from a certificate.

SOC 2 is not a certificate. It is a report by a US certified public accountant (CPA), who examines a supplier's controls under standards set by the AICPA, the US professional body for accountants. Suppliers such as cloud providers and payroll processors use it to show customers how they protect their data.

The report is not public, so you ask the supplier for a copy.

A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality or privacy.

A type 1 report describes the controls on one date. In a type 2 report, the auditor also tests whether the controls worked in practice, and gives the results.

Each body takes its own report, so telling one does not tell the others.

After a UK cyber attack, you usually tell the police, and possibly the ICO if personal data was involved. The UK government's signposting service on GOV.UK shows you where to report. The NCSC runs it, and responds itself to the most critical incidents in the UK. What you tell this service is not shared with the ICO.

A cyber attack is also a crime. In England, Wales and Northern Ireland, you report it to the police through Report Fraud, and in Scotland by calling 101.

If personal data was involved, you may also need to report a breach to the ICO, the UK data protection regulator. UK GDPR says to report without undue delay and, where feasible, within 72 hours of becoming aware of it. The duty does not apply to a breach that is unlikely to put people's rights and freedoms at risk.

If ransomware locks personal data, the ICO says that is a personal data breach, because you have lost timely access to the data. See the first days after an attack.