Cyber Essentials is a UK Government-backed scheme designed to help businesses of all sizes protect against common cyber threats. It demonstrates your commitment to cybersecurity and is often mandatory for securing government and industry contracts.

Cyber Essentials involves a self-assessment verified by Tranchulas, while Cyber Essentials Plus includes an additional technical audit by our expert assessors, offering enhanced assurance of your cybersecurity measures.

Once you register, you’ll receive access to an online portal to complete a self-assessment questionnaire about your IT infrastructure and security controls. Our team provides guidance throughout this step, answering any queries you have. After submission, a Tranchulas-certified assessor reviews your responses, typically within 2-3 working days. Upon successful verification, you’ll receive your Cyber Essentials certificate. If revisions are needed, you’ll receive clear instructions on necessary adjustments.

For Cyber Essentials Plus, after obtaining your basic Cyber Essentials certification, our assessors will conduct a detailed technical audit—including vulnerability scans and device assessments. Cyber Essentials Plus must be completed within three months of achieving your basic certification.

Yes, achieving basic Cyber Essentials certification is mandatory before undertaking the Cyber Essentials Plus audit.

The Danzell question set applies to Cyber Essentials assessments purchased from 27 April 2026 and aligns with the Requirements for IT Infrastructure v3.3. The five core technical controls remain unchanged.

• Cloud account protection: Multi-factor authentication (MFA) must be enabled on cloud services wherever it is available, including paid options. Missing available MFA results in an automatic assessment failure.
• Security updates: High-risk or critical updates and vulnerability fixes for operating systems, router and firewall firmware, and applications must be installed within 14 days of release. Failure to meet these requirements results in an automatic assessment failure.
• Assessment preparation: Use the current Danzell question set and requirements when preparing your application. Our team can explain how they apply to your organisation.

Read IASME’s official 2026 update.

You’ll need basic cybersecurity controls including firewalls, secure device configurations, user access controls, malware protection, and timely application of software updates.

Typically, certification can be achieved within a few days of submitting your completed self-assessment. Tranchulas aims to review submissions within 2-3 working days.

It’s common to need minor adjustments. Tranchulas provides clear feedback and guidance on required changes, offering a free reassessment opportunity to ensure you succeed.

We provide comprehensive email-based support throughout your self-assessment, clarifying requirements, advising on improvements, and helping ensure you meet the standards.

Certification must be renewed annually to ensure your cybersecurity remains robust and aligned with the latest standards.

Review the latest requirements, ensure your IT assets are updated and documented, apply necessary security patches, and create or update your security policies. Tranchulas can assist you at each stage of your preparation.

Yes, upon successful certification, you receive complimentary cyber insurance covering your business up to £25,000.