A customer sends over a new supplier form.
Halfway down, there’s a question:
“Do you hold Cyber Essentials certification?”
If the answer is no, you might not get any further.
More and more larger customers, public-sector buyers and insurers are asking that question. So what is Cyber Essentials, and what does it actually check?
What Is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme, run by the National Cyber Security Centre (NCSC), that shows your business has the basic protections in place against the most common cyber attacks.
Think of it like an MOT. It doesn’t mean your car can never break down. It means the essentials have been checked and meet a recognised standard.
There are two levels:
- Cyber Essentials: you complete a self-assessment questionnaire, which is checked by an independent certification body
- Cyber Essentials Plus: the same requirements, plus a hands-on technical audit where an assessor tests your devices to confirm the controls really are in place
The Five Things It Checks
1. Firewalls
Every device that connects to the internet should be protected by a properly configured firewall, with default passwords changed and unnecessary access closed off.
2. Secure configuration
Computers and devices should be set up securely, not left on factory settings. That means removing software you don’t need and making sure devices lock when they aren’t in use.
3. Security update management
This is the one that catches a lot of businesses out. Critical and high-risk security updates must be installed within 14 days of being released. That includes Windows, other software, and the firmware on devices like firewalls.
4. User access control
People should only have the access they need. Admin accounts should be separate from everyday accounts. And under the current requirements, every cloud service must use multi-factor authentication (MFA), such as Microsoft 365.
5. Malware protection
Devices need protection against viruses and other malicious software, kept up to date and switched on.
What Changed in 2026
The latest version of the requirements came into force on 27 April 2026. Two changes stand out:
- MFA on cloud services is now an automatic fail. If a cloud service offers MFA and it isn’t switched on, you fail.
- Missing the 14-day update rule is also an automatic fail.
In other words, the two things many businesses were hoping to get away with are now the two things you can’t.
Why Manufacturers Get Caught Out
Manufacturing sites often have older machines, shared computers on the shop floor and equipment that runs on software nobody wants to touch. These can be the devices that fail the update rule.
That doesn’t mean manufacturers can’t pass. It means the scope, and how those devices are handled, needs thinking about early.
Is Cyber Essentials Worth It?
For most businesses, yes. It:
- Opens the door to contracts that require it
- Reassures customers that you take security seriously
- Fixes the basic gaps that most attacks rely on
- Gives you a clear checklist, rather than guessing
The certificate lasts for 12 months, so it also makes sure the basics are revisited every year.
Frequently Asked Questions
How long does Cyber Essentials take?
If your IT is already in good shape, the questionnaire itself doesn’t take long. Most of the time goes into fixing the gaps it uncovers, such as missing updates or MFA.
Can we fail Cyber Essentials?
Yes. That’s why it’s worth checking your setup against the requirements before you apply.
Need Help?
At Affirm IT, we help businesses get ready for Cyber Essentials by starting with simple questions:
- Is MFA switched on for every cloud service?
- Are security updates going on within 14 days?
- Are admin accounts separate from everyday accounts?
- Which devices are in scope, including the shop floor?
From there, we close the gaps so you can apply with confidence. You can read more about our cyber security services.
Want a quick view of where you stand? Take our free 2-minute IT scorecard. Four questions, an instant result, and no email needed unless you want the breakdown.
Or get in touch with us. At Affirm IT, we provide IT support for manufacturers and managed IT support in Derbyshire and across the East Midlands.
