Compliance tools · Cybersecurity and data protection

Cyber Essentials compliance tool

NCSC Cyber Essentials Scheme · United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Cyber Essentials documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Cyber Essentials is NCSC Cyber Essentials Scheme, a voluntary standard in the United Kingdom. UK government-backed baseline cybersecurity certification. Required for many public contracts.

The free assessment screens for Cyber Essentials when a business bids for or holds public sector contracts.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Cyber Essentials: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Cyber Essentials applies to your business, free →

Does Cyber Essentials apply to my business?

You must hold a valid Cyber Essentials certificate if you bid for UK government contracts involving handling of personal data or providing certain ICT products and services, as a contractual prerequisite under the Supply Chain Requirement. For every other UK organisation, certification is voluntary.

Who does Cyber Essentials apply to?

The scheme applies to organisations of all sizes including SMEs, charities, and public bodies (Scheme Overview). It falls on the applicant organisation and on senior management within it, and the 31 entity-facing obligations are the ones that bind you.

Does Cyber Essentials apply to a small business?

The scheme has no size threshold. It applies to organisations of all sizes including SMEs, charities, and public bodies (Scheme Overview), and NCSC designed it to be accessible and affordable for small organisations.

When does Cyber Essentials apply from, and what are the deadlines?

Certification is valid for 12 months and you must recertify annually by resubmitting the SAQ, and for Plus by undergoing a fresh technical assessment. High or critical security patches must be applied within 14 days of release (Control Theme 3.1), and anti-malware signatures updated at least daily (Control Theme 5.2).

What does Cyber Essentials require me to do?

You must apply the five control themes within a defined scope boundary: firewalls, secure configuration, security update management, user access control, and malware protection. You must complete and submit the SAQ with senior management attestation, and for Plus submit to independent technical assessment.

What records or documents does Cyber Essentials require me to keep or produce?

You must keep records sufficient to demonstrate ongoing conformance with all five control themes, including asset inventories, configuration baselines, patch records, and access control reviews. You must also produce a scope definition document, network diagram, and asset inventory.

What happens if I do not comply with Cyber Essentials?

Cyber Essentials carries no statutory fines and no regulator imposes financial penalties for failing to certify or for losing certification. Non-certification means you cannot bid for the covered UK government contracts, may face contract termination, removal from the IASME public register, and possible fraud liability for false attestation.

How do I start complying with Cyber Essentials?

The first practical step is to define and document a clear scope boundary identifying all devices, software, cloud services, and networks included in the certification assessment. The scope boundary determines which assets the five control themes apply to.

Which ComplianceSME account includes the Cyber Essentials toolkit?

The Cyber Essentials agent toolkit is included from the Small level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive