Cyber Essentials is a UK Government-backed scheme designed to help businesses of all sizes protect against common cyber threats. It demonstrates your commitment to cybersecurity and is often mandatory for securing government and industry contracts.

Cyber Essentials involves a self-assessment verified by Tranchulas, while Cyber Essentials Plus includes an additional technical audit by our expert assessors, offering enhanced assurance of your cybersecurity measures.

Once you register, you’ll receive access to an online portal to complete a self-assessment questionnaire about your IT infrastructure and security controls. Our team provides guidance throughout this step, answering any queries you have. After submission, a Tranchulas-certified assessor reviews your responses, typically within 2-3 working days. Upon successful verification, you’ll receive your Cyber Essentials certificate. If revisions are needed, you’ll receive clear instructions on necessary adjustments.

For Cyber Essentials Plus, after obtaining your basic Cyber Essentials certification, our assessors will conduct a detailed technical audit—including vulnerability scans and device assessments. Cyber Essentials Plus must be completed within three months of achieving your basic certification.

Yes, achieving basic Cyber Essentials certification is mandatory before undertaking the Cyber Essentials Plus audit.

From 28 April 2026, all new Cyber Essentials assessments use the Danzell question set, which replaces Willow. Key changes include:

Mandatory Multi-Factor Authentication: MFA must be enabled on all cloud services where it is available. Assessments now automatically fail if MFA is not in place.

14-Day Patching Deadline: All critical and high-risk security updates must be installed within 14 days of release — this is now an auto-fail requirement.

Broader Device Scope: All internet-connected organisational devices are in scope by default and can only be excluded with explicit justification.

Stricter Cyber Essentials Plus Testing: Tightened verification of device sampling and scope accuracy during CE+ assessments.

Assessments started before 26 April 2026 may still complete under the previous Willow question set. Tranchulas will guide you through the updated requirements and help you close any gaps — such as enabling MFA across your cloud services — before you submit.

You’ll need basic cybersecurity controls including firewalls, secure device configurations, user access controls, malware protection, and timely application of software updates.

Typically, certification can be achieved within a few days of submitting your completed self-assessment. Tranchulas aims to review submissions within 2-3 working days.

It’s common to need minor adjustments. Tranchulas provides clear feedback and guidance on required changes, offering a free reassessment opportunity to ensure you succeed.

We provide comprehensive email-based support throughout your self-assessment, clarifying requirements, advising on improvements, and helping ensure you meet the standards.

Certification must be renewed annually to ensure your cybersecurity remains robust and aligned with the latest standards.

Review the latest requirements, ensure your IT assets are updated and documented, apply necessary security patches, and create or update your security policies. Tranchulas can assist you at each stage of your preparation.

Yes, upon successful certification, eligible organisations (UK-domiciled, under £20m annual turnover, certifying the whole organisation) receive complimentary cyber insurance covering the business up to £25,000.