Cyber Essentials Certification for Irish Businesses

Cyber Essentials is a UK government-backed certification that shows your business has five basic technical controls in place: firewalls, secure configuration, security updates, user access control and malware protection. The basic level costs from £320 plus VAT through IASME and lasts 12 months. ERS IT Solutions in Blanchardstown, Dublin 15, holds Cyber Essentials certification itself and guides Irish clients through their own assessment.

What is Cyber Essentials certification?

Cyber Essentials was developed by the UK's National Cyber Security Centre as the minimum standard of cyber security it recommends for organisations of all sizes. IASME is the NCSC's delivery partner, and it licenses certification bodies to run assessments.

There are two levels:

• Cyber Essentials is a verified self-assessment. You answer an online question set about your IT, a director signs it off, and a qualified assessor marks it.
• Cyber Essentials Plus covers the same five controls, but an assessor also tests your systems in person or remotely to check the controls actually work.

Is Cyber Essentials recognised in Ireland?

To be accurate: Cyber Essentials is a UK scheme, not an Irish or EU one. No Irish law requires it, and Ireland has no official equivalent today. It is open to Irish organisations, and it is useful here for three reasons.

First, any Irish business that sells to the UK public sector may need it: IASME notes it is now required in a large number of UK central government contracts. Second, Irish customers increasingly ask suppliers for evidence of basic controls, and a current certificate is a quick, checkable answer. Third, the five controls line up with the "basic cyber hygiene" and access control measures in NIS2. The certificate does not make you NIS2 compliant, but it is a sound first step. Read more in our NIS2 guide.

The Irish NCSC has announced its own forthcoming "Irish Cyber Security Measures Certification" scheme, which it says will include a level aimed at SMEs. Until that exists, Cyber Essentials is the most widely used small-business baseline available to Irish firms.

How much is Cyber Essentials?

For Cyber Essentials pricing, IASME publishes a fixed, tiered fee for the basic Cyber Essentials assessment based on staff numbers. These are IASME's own prices from its Cyber Essentials FAQ:

The fee is only the assessment. What usually costs more is getting ready: replacing unsupported software or old devices, turning on MFA for every cloud service, tidying admin accounts and fixing firewall rules. That depends on how up to date your IT already is. ERS quotes per business after a short call, once we have seen what needs fixing.

If you fail, IASME gives you two working days to fix simple issues and resubmit at no extra charge. After that you would reapply and pay again.

How much is Cyber Essentials Plus?

Cyber Essentials Plus is not a fixed price. IASME and the UK NCSC both say it is quoted, because the cost depends on the size and complexity of the network being tested. The assessor tests a sample of user devices (typically around 10 per cent), all internet gateways and all servers that unauthenticated internet users can reach. The number of locations, device types and cloud services changes the quote.

If you passed the basic Cyber Essentials less than three months before your Plus assessment, you do not need to repeat the self-assessment stage.

Cyber Essentials vs Cyber Essentials Plus

Start with Cyber Essentials. Move to Plus when a customer or contract asks for it, or once the basic controls are settled and you want proof they work in practice.

What are the five Cyber Essentials controls?

The Requirements for IT Infrastructure v3.3 group everything under five technical controls:

1. Firewalls. A boundary firewall or equivalent protects every device in scope, default admin passwords are changed and unneeded inbound rules are removed.
2. Secure configuration. Unnecessary software and accounts are removed, default passwords are changed and auto-run is disabled.
3. Security update management. All software is licensed and supported, and critical or high-risk updates are applied within 14 days.
4. User access control. Accounts are only given to those who need them, admin rights are kept separate from day-to-day work, and MFA is used.
5. Malware protection. Anti-malware or application allow-listing is in place on devices.

These are the same five areas ERS was independently assessed on for its own certification.

What are the Cyber Essentials requirements in 2026?

Version 3.3 of the requirements (question set "Danzell") has applied to new assessments since 27 April 2026. Applications started before that date can continue under version 3.2, which ran from 28 April 2025. The main points of v3.3, from the NCSC requirements document:

• A clear definition of "cloud services", and a definitive statement that cloud services cannot be excluded from scope.
• An updated definition of passwordless authentication that includes FIDO2.
• A Software Security Code of Practice added to the software development section.
• Greater emphasis on backing up data.

If you searched for "cyber essentials requirements for IT infrastructure v3.2", note that v3.2 is now the previous version.

What are the Cyber Essentials MFA and password requirements?

Under v3.3, authentication to cloud services must always use MFA, and MFA should be used elsewhere where available. Where MFA is in place, the password part must be at least 8 characters with no maximum length.

For passwords, you must use one of these technical controls: MFA; a minimum length of 12 characters; or a minimum of 8 characters with automatic blocking of common passwords. The requirements tell you not to enforce regular password expiry or complexity rules, and to support staff with password managers and the "three random words" approach. That is the basis of a compliant Cyber Essentials password policy.

What are the Cyber Essentials patching requirements?

All software on in-scope devices must be licensed, supported and removed when it goes out of support. Automatic updates should be on where possible. Updates must be installed within 14 days of release where the vendor rates the fix "critical" or "high risk", where the vulnerability scores 7 or above on CVSS v3, or where the vendor gives no severity at all. Running unsupported software in scope, such as an old Windows version, is an automatic fail.

Cyber Essentials checklist

Use this before you apply. It follows the v3.3 requirements.

1. Decide your scope. The whole organisation is simplest, and cloud services must be included.
2. List every device, server, cloud service and piece of software in scope.
3. Remove or isolate anything unsupported.
4. Confirm a firewall protects every device, including home workers' laptops.
5. Change all default passwords and remove unused accounts and software.
6. Turn on automatic updates and confirm critical patches go on within 14 days.
7. Turn on MFA for every cloud service, starting with Microsoft 365.
8. Separate admin accounts from everyday accounts.
9. Check anti-malware is active and updating on every device.
10. Download the free question set and answer it in draft before you pay.

For Cyber Essentials Plus, add: run vulnerability scans on a sample of devices, test that malicious attachments and downloads are blocked, and make sure MFA works on every cloud account the assessor checks.

How long does it take to get Cyber Essentials?

IASME says that if you have prepared your answers in advance, the self-assessment itself might take about an hour, and most assessors aim to return results within three days. You have six months from application to submit. The real time is in preparation: a well-run office can be ready in a couple of weeks, while a business with old devices and no MFA may need longer to fix gaps first.

How long does Cyber Essentials last?

Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, so you renew every year. IASME emails a reminder roughly a month before. Certified organisations appear on IASME's public list, which is how customers check a supplier, and IASME removes organisations that have not recertified in the past year.

Cyber Essentials vs ISO 27001 and SOC 2

Cyber Essentials is narrow and technical: five controls, checked once a year, for a few hundred pounds. ISO 27001 is a full information security management system covering risk assessment, policies, people, suppliers and 93 Annex A controls, audited by an accredited body on a three-year cycle. SOC 2 is a US attestation report from a CPA firm, mostly asked for by American customers of software and service companies.

For an Irish SME, the usual order is Cyber Essentials first, then ISO 27001 if customers or tenders require it. Cyber Essentials Plus vs ISO 27001 is a similar choice: Plus gives hands-on proof of the technical basics, ISO 27001 proves you manage security as a system. Our ISO 27001 guide and ISO 27001 vs SOC 2, NIST and other frameworks explain the differences in more depth.

How ERS helps you get Cyber Essentials

ERS has been through the Cyber Essentials assessment itself and was independently verified on secure configuration, boundary firewalls, access control, malware protection and patching. Many of our SME and public sector clients ask us to guide them through theirs.

1. Readiness check. We review your devices, Microsoft 365 tenant and firewall against the v3.3 requirements and give you a short list of fixes.
2. Remediation. Our engineers fix the gaps: patching, MFA, admin accounts, device configuration and unsupported software.
3. Support through the assessment. We help you answer the question set accurately and prepare for Plus testing if you need it.
4. Staying certified. Our managed cyber security services keep patching, monitoring and mobile device management running so renewal next year is straightforward.

ERS quotes per business after a short call. Contact us or call 01 885 9500.