Requirements & evidence
UK Cyber Essentials
The UK government-backed certification scheme for five foundational technical controls. Cyber Essentials is questionnaire-based; Cyber Essentials Plus adds independent technical verification. Tracking the requirements does not claim either certificate.
- Edition on record
- Requirements for IT infrastructure v3.3
- Issuing authority
- UK National Cyber Security Centre (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for all sectors, government suppliers, small and medium businesses, across UK. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
5 source entries on record
Five technical control themes in Cyber Essentials v3.3. This is not a count of individual assessment questions or test procedures.
Source access and licensing
NCSC publishes the technical requirements under UK Crown copyright. Pin the v3.3 requirements and applicable reuse terms before normalization.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
UK Cyber Essentials is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; requirements, assessment questions, and Cyber Essentials Plus test specifications are not ingested or implemented.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- Requirements for IT infrastructure v3.3Current edition on record · Replaces Requirements for IT infrastructure v3.2
- Requirements for IT infrastructure v3.2Superseded edition
Recorded change history
· UK Cyber Essentials Requirements for IT infrastructure v3.3 supersedes Requirements for IT infrastructure v3.2 and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- UK National Cyber Security Centre (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: uk-cyber-essentials-v3-3.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Firewalls · Secure configuration · Security update management · User access control · Malware protection.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is UK Cyber Essentials?
The UK government-backed certification scheme for five foundational technical controls. Cyber Essentials is questionnaire-based; Cyber Essentials Plus adds independent technical verification. Tracking the requirements does not claim either certificate.
Who does UK Cyber Essentials apply to?
UK Cyber Essentials applies to all sectors, government suppliers, small and medium businesses, UK, per UK National Cyber Security Centre.
What is the current version of UK Cyber Essentials?
The current edition is Requirements for IT infrastructure v3.3, issued by UK National Cyber Security Centre and published 2026-04-27. Source: https://www.ncsc.gov.uk/cyberessentials/resources.
What does an assessment under UK Cyber Essentials require?
5 control units are on record (Five technical control themes in Cyber Essentials v3.3. This is not a count of individual assessment questions or test procedures.), organized into 5 control families: Firewalls, Secure configuration, Security update management, User access control, Malware protection.
At a glance
UK Cyber Essentials
Requirements for IT infrastructure v3.3
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize UK Cyber Essentials requirements, evidence preparation, and review for your assessment scope.