What it checks
The scheme covers five controls that guard against the most common attacks:
- Firewalls that guard your internet connection.
- Safe settings on your devices and software.
- Only the right people can get into each account.
- Protection against harmful software.
- Updates put on in good time.
How you get it
You answer a set of questions online about each of the five controls, and a certification body checks your answers. Cyber Essentials Plus adds a hands-on test by an assessor. You renew each year. Many firms first check themselves against the five controls, then fix the gaps before they apply.
Who needs it
Some public sector contracts ask suppliers to hold it. Even if no customer asks, the five controls make a good checklist for any business. Holding it also shows customers that you take the basics seriously.
Is Xevrion the same as being certified?
No. Xevrion's Security part shows how ready you are for each control and what is left to do. Readiness is a checklist, not a certificate, so it proves nothing to a customer. Only an IASME certification body can certify you.
Sources
- Cyber Security Breaches Survey 2025. Department for Science, Innovation and Technology. Published 2025.
- Cyber Essentials. National Cyber Security Centre. Checked 4 October 2026.
Last checked: 4 October 2026.