Introducing AI Operating System for Business & School — our most powerful products yet.Explore products →
App Corp
Full-service software engineering
Engineering your experience…
App Corp
Full-service software engineering
Engineering your experience…
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC) that helps organisations protect themselves against the most common cyber attacks. It requires five key technical controls: firewalls and secure configuration, secure configuration for devices and software, user access control, malware protection, and patch management. The scheme has two levels — Cyber Essentials (self-assessment) and Cyber Essentials Plus (independent verification). For UK companies contracting with the government or handling sensitive data, Cyber Essentials is increasingly a mandatory requirement.
Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC) that helps organisations protect themselves against the most common cyber attacks. It requires five key technical controls: firewalls and secure configuration, secure configuration for devices and software, user access control, malware protection, and patch management. The scheme has two levels — Cyber Essentials (self-assessment) and Cyber Essentials Plus (independent verification). For UK companies contracting with the government or handling sensitive data, Cyber Essentials is increasingly a mandatory requirement.
All devices must be protected by a properly configured firewall or equivalent network boundary protection, with only approved and necessary services exposed to the internet.
Systems and software must be configured to minimise vulnerabilities — including removing or disabling unnecessary user accounts, closing unused network ports, and disabling unrequired services.
User accounts must be managed with least-privilege principles, including regular review of administrative privileges, use of separate accounts for administration, and appropriate authentication controls.
Approved malware protection must be deployed on all systems, with signatures kept up to date, and automated scanning scheduled to run at appropriate intervals.
All software and operating systems must be kept up to date with security patches applied within 14 days for critical vulnerabilities, using automated patch management where possible.
Cyber Essentials aligns closely with the operational security baseline we maintain for our own infrastructure and the platforms we build for UK clients. The five controls map directly to standard engineering practices we already enforce — automated patch management, CI/CD-hardened configurations, principle of least privilege for all service accounts, and network segmentation. For UK clients requiring Cyber Essentials Plus certification, we document each control alongside the supporting evidence, making the independent verification process straightforward. Our engineering environments are Cyber Essentials-ready by default.
Explore other compliance standards we engineer for.
The United Kingdom's post-Brexit data protection framework — nearly identical to EU GDPR but independently enforced by the ICO.
Learn moreThe internationally recognised standard for information security management systems — the most widely adopted certification for security excellence.
Learn moreThe gold standard for service organisations — audited security controls that prove your platform protects customer data.
Learn moreTell us about your compliance requirements and we'll show you how our engineering team can build a system that meets every regulatory standard that matters to your business.
Free consultation. No obligation. Response within 2 business hours.
We have shipped 200+ projects for clients across fintech, healthtech, SaaS, and enterprise — many requiring multi-framework compliance.