Get audit-ready for Cyber Essentials
Cyber Essentials / CE+ · UK NCSC Cyber Essentials
UK government-backed scheme helping organizations protect against common cyber attacks. Cyber Essentials Plus includes hands-on technical verification of controls.
Cyber EssentialsWhat is Cyber Essentials?
UK government-backed scheme helping organizations protect against common cyber attacks. Cyber Essentials Plus includes hands-on technical verification of controls.
Who it applies to
Organisations bidding for UK government contracts, where it is frequently a minimum condition. Also used by smaller UK businesses as a low-cost baseline.
How the standard is organised
Five technical control themes covering firewalls, secure configuration, access control, malware protection and patching. Cyber Essentials is a verified self-assessment; Cyber Essentials Plus adds hands-on technical testing.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
Cyber Essentials on the Bitkosh platform
The 28 Cyber Essentials controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- CE-FW-5Remove unnecessary firewall rules promptly
Clean up firewall rules once they're no longer needed instead of letting stale openings pile up.
Firewalls - CE-SC-3Disable auto-run and auto-play
Turn off auto-run/auto-play so a file can't launch itself the moment something's plugged in.
Secure Configuration - CE-FW-3Block unauthenticated inbound connections by default
Inbound connections are blocked by default unless someone's documented a real business reason to let them through.
Firewalls - CE-SUM-5Keep firmware and applications updated
Keep everything patched across the board -- firmware, OS, applications -- on every device that's in scope.
Security Updates - CE-UAC-3Remove or disable accounts no longer required
Kill or disable an account fast once someone leaves or no longer needs the access -- don't let it linger.
User Access Control - CE-UAC-7Admin accounts not used for browsing or email
Never use an admin account for everyday browsing or email -- that's exactly the kind of activity that gets accounts compromised.
User Access Control
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes Cyber Essentials, and who does it apply to?
How is Cyber Essentials conformance demonstrated?
How is Cyber Essentials structured?
Ready to get audit-ready for Cyber Essentials?
See how the Bitkosh Readiness Platform gets you audit-ready for Cyber Essentials — and the other 47 ready frameworks — from a single control library.