Cyber Essentials is a UK government-backed certification scheme, and while it originated in the UK, it is increasingly recognised and required by organisations operating across the Irish and British markets. For Irish SMEs supplying into UK public sector contracts, or working with UK-regulated financial services firms, Cyber Essentials has become a practical commercial requirement.
More importantly, the five control areas that Cyber Essentials covers represent a sound baseline for any business — regardless of certification. If your organisation cannot demonstrate these controls, you have real security exposure. If you can, certification is an achievable and commercially valuable credential.
What Is Cyber Essentials?
Cyber Essentials is a certification scheme that assesses whether an organisation has implemented five fundamental technical controls that protect against the most common cyber threats. It is run in the UK by the National Cyber Security Centre (NCSC) and administered by a number of accredited certification bodies.
There are two tiers:
- Cyber Essentials — a self-assessment questionnaire reviewed by a certification body
- Cyber Essentials Plus — the same controls, independently tested by an assessor
For most Irish SMEs, Cyber Essentials (self-assessment) is the appropriate starting point. Plus is required for some UK public sector contracts.
Why Irish Businesses Are Pursuing Cyber Essentials in 2026
Several factors have driven increased uptake among Irish companies:
- UK public sector and NHS supply chain mandates requiring all suppliers to hold Cyber Essentials
- Financial services firms requesting it from technology vendors during procurement
- Increasing use as a proxy for "minimum viable security" in enterprise vendor assessments
- The NIS2 Directive (effective in Ireland from October 2024) raising baseline security expectations for a wider range of organisations
The Five Control Areas: What They Require
1. Firewalls
Every device connected to the internet must be protected by a firewall, and that firewall must be properly configured. This means:
- Boundary firewalls on internet-facing systems
- Host-based firewalls on all end-user devices (laptops, desktops)
- Firewall rules reviewed and documented — no "allow all" rules without justification
- Unapproved services blocked by default
- Default administrator passwords changed on all network devices
2. Secure Configuration
All computers and network devices must be configured securely. The most common gaps:
- Default passwords left unchanged on routers, printers, cloud service accounts
- Unnecessary software and services running on devices
- Auto-run features enabled (allowing malicious code to execute from USB devices)
- No documented configuration baseline
For cloud infrastructure, this extends to your AWS, Azure or GCP environment — storage buckets, API access, administrative accounts.
3. User Access Control
Access to systems and data should be controlled and limited to what each user actually needs. Requirements include:
- Standard user accounts used for day-to-day work (not administrator accounts)
- Administrator accounts used only for administrative tasks
- Separate administrator accounts for each person who needs admin access — no shared accounts
- Access removed promptly when someone leaves or changes role
- Multi-factor authentication (MFA) required for all remote access and cloud service administration
4. Malware Protection
All devices must be protected against malware. This can be achieved through:
- Up-to-date anti-malware/endpoint protection software on all devices
- Application whitelisting (allowing only approved applications to run)
- Sandboxing for email attachments and web downloads
For most SMEs, a centrally managed endpoint protection solution covering all devices is the practical path. The assessor will check that definitions are current and that the solution covers all in-scope devices.
5. Patch Management
Operating systems and all software must be kept up to date. Requirements include:
- All in-scope devices running a supported OS (no Windows 7, Windows Server 2008, etc.)
- High and critical patches applied within 14 days of release
- Unsupported software removed or clearly justified with compensating controls
- Automatic updates enabled where possible
This is the control area most Irish SMEs fail on initial self-assessment — not because patching is hard, but because nobody has documented which devices are in scope and verified their patch status.
The Cyber Essentials Checklist for Irish SMEs
Before submitting a self-assessment, work through this checklist:
Firewalls ✓
- ☐ All internet-facing systems protected by boundary firewall
- ☐ Host-based firewalls enabled on all laptops and desktops
- ☐ Firewall rules documented and reviewed
- ☐ Default admin passwords changed on all network devices
- ☐ Inbound services restricted to what is genuinely needed
Secure Configuration ✓
- ☐ Default passwords changed on all accounts and devices
- ☐ Unnecessary software removed or disabled
- ☐ Auto-run disabled on all devices
- ☐ Cloud storage reviewed — no unintentional public access
- ☐ MFA enabled on all cloud service administrator accounts
User Access Control ✓
- ☐ Standard accounts used for day-to-day work
- ☐ Admin accounts separate and named (no shared admin accounts)
- ☐ Offboarding process removes access within 24 hours
- ☐ MFA required for all remote access
- ☐ Access rights reviewed in the last 12 months
Malware Protection ✓
- ☐ Endpoint protection deployed to all in-scope devices
- ☐ Definitions updated automatically (within 24 hours of new release)
- ☐ Central management console gives visibility of all device status
- ☐ Coverage verified — no unmanaged devices in scope
Patch Management ✓
- ☐ All devices running a supported OS
- ☐ High/critical patches applied within 14 days
- ☐ Software inventory documented
- ☐ Unsupported software justified or removed
- ☐ Automatic updates enabled or a manual process documented
How Long Does Cyber Essentials Take?
For an Irish SME with 10–50 employees starting from a reasonable security baseline:
- Preparation: 4–8 weeks (depending on gaps found)
- Self-assessment completion: 1–2 days
- Certification body review: 5–10 business days
Total elapsed time from decision to certificate: typically 6–12 weeks.
What to Do If You Have Gaps
If this checklist reveals gaps, don't submit the assessment until they're fixed. A gap review with a specialist will tell you which items are genuinely blocking certification and which can be addressed quickly. In our experience, most Irish SMEs have a small number of high-impact gaps (typically cloud misconfiguration, MFA gaps and patch documentation) that can be resolved in two to four weeks once clearly identified.
Not Sure Where You Stand?
Book a free governance review. We'll assess your readiness against the Cyber Essentials control areas and give you an honest view of your gap — so you know what to fix before you pay for certification.
Book Free Review →