Cyber Essentials update at a glance:
Effective date: 28 April 2025
Changes: The Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certification schemes aim for enhanced authentication, remote work recognition, and improved vulnerability management.
Affected parties: All UK businesses with data or digital assets seeking/needing CE or CE+.
Non-compliance: Businesses must fix high/critical vulnerabilities within 14 days of a fix release. Failure may result in loss of certification, impacting operations and reputation.
Modernising CE and CE+
Since 2014, the government-backed certification standard Cyber Essentials has been helping UK businesses of all shapes and sizes guard against the most common types of cyber attacks. If you store data or have digital assets, Cyber Essentials can help keep them safe.
As of April 2025, significant updates have been implemented to the Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certification schemes to ensure they remain relevant in today's evolving digital landscape. These changes, introduced in the "Willow" version effective 28 April 2025, seek to strengthen cyber security standards and address modern working practices.
Enhanced authentication methods
The 2025 update expands beyond the multi-factor authentication requirements introduced in 2022 to include passwordless authentication options such as:
- Biometrics
- One-time codes
- QR codes
- Security tokens
- Push notifications
These methods significantly reduce risks associated with password reuse and phishing attacks by eliminating traditional password vulnerabilities.
Remote work recognition
Terminology has changed from "home working" to "home and remote working," acknowledging that employees frequently access company systems from various untrusted locations, including hotels, cafes, and public transport.
Organisations must implement robust security measures for all remote access scenarios, with a mandatory assessment of cloud security configurations.
Vulnerability management enhancement
The scheme now provides a more precise definition of "vulnerability fixes" extending beyond traditional patching. This broader approach encompasses the following:
- Registry fixes
- Configuration changes
- Scripts
- Other vendor-approved remediation methods
Under the new Willow specification, the business must resolve all vulnerabilities rated as high or critical risk (CVSS v3.1 base score of 7.0 or above) within 14 days of releasing a fix.
Audit timeline
CE+ assessments may start soon after a 72-hour notice
CE+ requires the completion of technical audits within 30 days of a notice being served. However, from the point of notice, the assessment could start after a 72-hour (or 3 working days) timeframe has been observed, emphasising that cyber security must be "business as usual" rather than a periodic compliance exercise.
International standards alignment
The updated framework aligns more closely with global cyber security standards, including those from the National Institute of Standards and Technology (NIST). This alignment enhances credibility for UK businesses working with international partners and clients.
In April 2025, NCC Group released the 3rd edition of our Global Cyber Policy Radar Report, enabling businesses to deeply understand and meet their domestic and international compliance obligations. Download your free copy here.
Business implications
The 2025 updates reinforce that Cyber Essentials should be integrated into everyday business operations rather than treated as an annual tick-box exercise. Organisations that embed these practices as Business as Usual (BAU) will:
- Shift from reactive to proactive cyber security posture
- Maintain critical security controls consistently
- Catch misconfigurations and vulnerabilities early
- Build operational confidence among staff and stakeholders
- Gain a competitive advantage in procurement processes
- Experience smoother certification renewals
What UK businesses must do
To prepare for and comply with the updated requirements, UK businesses should:
1. Review authentication systems - Evaluate and implement appropriate passwordless authentication options to strengthen access security.
2. Enhance remote access policies - Update security measures for all remote working scenarios, ensuring robust protection regardless of employee location.
3. Implement effective vulnerability management - Establish processes to identify, assess, and remediate high and critical vulnerabilities within the required 14-day window.
4. Document unsupported software - Identify and clearly document any unsupported software or cloud services in scope, with appropriate justification and risk mitigation measures.
5. Integrate compliance as BAU - Transform Cyber Essentials compliance from an annual project to an ongoing business process with regular monitoring and maintenance.
6. Be alert to CE+ assessments (72 hour notice period) - You’ll now be notified that you have 72 hours to prepare for an assessment, but then the CE+ test could take place anytime within a 30-day timeframe. Ensure systems and documentation are continuously maintained in an audit-ready state to accommodate the accelerated assessment timeline.
7. Align with International Standards and Regulations - Whilst it isn't a direct requirement of the new 'Willow' update, NCC Group recommends all CE/CE+ applicants to also assess for global cyber security frameworks relevant to their business or supply chains (international or sector markets).
By treating Cyber Essentials as a framework for ongoing cyber resilience rather than merely a certification requirement, UK businesses can achieve compliance and establish meaningful protection against the evolving threat landscape.
Early preparation and a thorough understanding of these changes will help organisations strengthen their defences while streamlining the certification process.
Get our support – Ultimate CE/CE+ preparation
For over a decade, we've been helping our clients to prepare as best as possible before submitting the self-assessment questionnaire (SAQ) by conducting vulnerability scans, recommending and supporting any fixes, patches, or updates, and outlining any other remediation actions required ahead of obtaining your CE/CE+ certification.
Our Cyber Essentials services are conducted exclusively by experienced specialists with the skills and qualifications needed to meet the requirements set out by NCSC. We'll introduce you to one of our dedicated CE assessors, who have a wealth of technical and compliance expertise across the cyber landscape.
The assessment team operates seamlessly and will conduct their work without creating any disruption or operational downtime to your business. Most our services can even be undertaken entirely remotely and within hours of finalising your needs.
Why are we so confident we can help?
Not only do we have an excellent track record, but we also evaluate SAQ submissions on behalf of IASME. For an extra bit of insight, here are some of the "Do's and Don'ts" we've captured based on our recent CE projects and evaluations:
Cyber Essentials certification made easy.
Tell us a bit more about your organisation and our experts would be happy to discuss how we can take you through CE or CE+ from start to finish.