Key Takeaways
- Confirm which level the customer needs before doing anything else, because Cyber Essentials and Cyber Essentials Plus are different assessments.
- Check the deadline against the scheme’s time limits: six months to complete an assessment, and Plus within 90 days of the standard certificate.
- Confirm that the certification covers the organisation, legal entities and IT infrastructure relevant to the customer’s requirements.
- Check your readiness against the five Cyber Essentials controls, particularly MFA, security updates and cloud services.
- Allow time for preparation, assessment and any necessary fixes, especially if the customer requires Cyber Essentials Plus
On this page
- Why Is a Customer Asking for Cyber Essentials?
- Which Level of Cyber Essentials Does the Customer Need?
- What Should You Do First?
- How Long Does Cyber Essentials Take When You Have a Deadline?
- What Evidence Will the Customer Expect to See?
- What Most Often Blocks Cyber Essentials Certification?
- Get Cyber Essentials Certified with OmniCyber
- Related Questions
A Customer Has Asked for Cyber Essentials: What Should You Do?
Last reviewed October 2026. Reflects Requirements for IT Infrastructure v3.3 and the Danzell question set.
When a customer asks for Cyber Essentials, start by confirming three things:
- Which level they need
- When the certificate must be in place
- What scope it should cover
Then check how ready your environment is and plan back from the deadline. Cyber Essentials is a verified self-assessment, while Cyber Essentials Plus adds an independent technical audit of your systems.
Why Is a Customer Asking for Cyber Essentials?
Customers and procurement teams ask for Cyber Essentials as independent evidence that a supplier has the basic technical controls in place. The request can come from a few sources:
- A customer contract or supplier due diligence process
- A tender or procurement framework that lists certification as a requirement
- A UK government contract where certification is required
- A cyber insurance conversation
Certification may be a formal condition or a preference depending on the customer’s requirements. Check any wording carefully for exactly what has been requested.
Which Level of Cyber Essentials Does the Customer Need?
There are two levels: Cyber Essentials, a verified self-assessment reviewed by a licensed Certification Body, and Cyber Essentials Plus, which adds an independent technical audit of your systems. Both assess the same five controls:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
Which level you need depends on what the customer has asked for, so check the wording of the request. Look for:
- A reference to “Plus”
- Language about an audit, technical testing or independent verification
Wording that only says Cyber Essentials may mean the standard level, but it is worth asking the customer to confirm in writing. A short email is far quicker than certifying at the wrong level.
For example, a supplier questionnaire might ask for “Cyber Essentials certification”, while a separate clause in the contract refers to independently verified technical controls. The second wording points towards Plus, so the supplier should confirm which level applies before starting.
What Should You Do First?
Before starting preparation, confirm the level the customer needs, the deadline for the certificate, the scope it should cover and who will own the work, so you know you are working towards the right certification.
- Confirm the level in writing. Ask the customer which certification they need.
- Confirm the deadline. Find out whether the certificate is needed at tender submission, at contract start or by a later date, then work back from that date.
- Confirm the scope. Establish which legal entities, devices, networks and cloud services need to be covered, and check that the proposed scope meets the customer’s requirements.
- Decide who owns it. Assign someone to manage the questionnaire, coordinate the necessary information and respond to assessor feedback. You’ll also need a senior member of staff to complete the final sign-off before the assessment can be formally submitted.
Once these are settled, you can plan the preparation work.
How Long Does Cyber Essentials Take When You Have a Deadline?
How long certification takes depends mainly on how ready your environment already is, but the scheme sets two fixed limits: six months to complete your assessment once your account is created, and 90 days to complete Plus after you achieve Cyber Essentials certification.
The six-month limit is the maximum permitted assessment window, not the typical time certification takes. The 90-day Plus limit (IASME guidance) also covers remediation: any retesting after the Plus audit must be completed within the permitted window, normally a maximum of 30 days from the initial audit and always within the overall 90-day window. Both certificates are valid for 12 months.
For example, if the Plus audit takes place on day 70 of the 90-day window, only 20 days remain for remediation and retesting, so any findings need to be treated as a priority.
Because Plus builds on the standard assessment, both stages and any remediation need to fit inside your customer’s timeline. Any non-conformities identified during the standard assessment must also be resolved before progressing to the Plus audit. If the starting position is unknown, a readiness check is a safer first step than booking the audit straight away.
For Cyber Essentials Plus, you’ll also need to ensure that relevant IT staff, devices and user accounts are available for the technical audit, as delays can reduce the time available for remediation.
OmniCyber’s GRACE (Guided Readiness Assessment for Cyber Essentials) is a one-day option for this situation. In the morning, a consultant works through your Cyber Essentials self-assessment with you. In the afternoon, a Plus-style technical review covers selected devices and your public infrastructure, followed by a summary report with next steps. GRACE is a readiness exercise rather than an official Plus audit, so it shows you where you stand in preparation for a full audit.
What Evidence Will the Customer Expect to See?
Most customers expect a valid Cyber Essentials or Cyber Essentials Plus certificate that covers the right organisation and scope. The exact evidence depends on the request, so check whether the customer wants the certificate itself, the certificate number or confirmation of scope.
A few points are worth checking:
- Level and validity. The certificate shows which level you hold and for how long it is valid.
- Legal entities and scope. Check which legal entities and parts of the organisation are covered by the certification, and confirm that this satisfies the customer’s contractual requirements.
- Verification. Certified organisations are listed in a directory, so a customer may be able to check your certification independently.
The information and evidence you need to gather to complete the assessment itself is a separate question.
What Most Often Blocks Cyber Essentials Certification?
Some of the requirements most likely to cause difficulties are MFA, cloud services, security update management and defining the assessment scope. Assessments are now carried out against version 3.3 of the NCSC requirements using the Danzell question set introduced on 27 April 2026.
- MFA. If a cloud service offers MFA, it must be enabled for administrators and users, and missing it is an automatic fail.
- Cloud services. Cloud services that store or process your organisation’s data must be included in the assessment scope and cannot be excluded. The security controls remain your responsibility, even where a third party manages the infrastructure.
- Security updates. High-risk and critical updates must be applied within 14 days of release, and missing the window is an automatic fail.
- Scope and inventory. Internet-connected devices (including employee-owned devices used for work), networks and cloud services must be considered when defining the scope, and any exclusions must be justified. An incomplete asset inventory may delay certification.
MFA and the 14-day window were expected before April 2026, but missing either is now an automatic fail. For Plus, a second sample of equal size is tested with no remediation window, so fixes need to be applied across the whole environment. Failing to demonstrate the required fixes in time may result in the Plus assessment failing, and the accreditor may also elect to revoke your Cyber Essentials certificate. Backups are strongly recommended but sit outside the five controls.
See our guide to the April 2026 Cyber Essentials changes for the full detail.
Get Cyber Essentials Certified With OmniCyber
OmniCyber is an IASME-licensed Certification Body with dedicated Cyber Essentials specialists and more than ten years of certification experience. We support first-time certification, renewals and Cyber Essentials Plus, with expert guidance to help you define your scope, understand the requirements and prepare for assessment. If you completed Cyber Essentials elsewhere and now need Plus, you can share your self-assessment answers and certificate with us before your Plus audit.
See our Cyber Essentials Certification Support page for the services included at each level.
Related Questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment, while Cyber Essentials Plus adds independent technical testing of the same five controls.
How much does Cyber Essentials certification cost?
Cost depends on the level of certification and the size and complexity of your organisation.
How do I prepare for Cyber Essentials certification?
Preparation starts with checking your environment against the five controls and confirming your scope.
Can I use my existing Cyber Essentials certificate for a new customer?
Yes, provided your certification is still valid and its scope meets the customer’s requirements. Check that the relevant organisation and IT infrastructure are covered, and confirm whether the customer requires Cyber Essentials or Cyber Essentials Plus.
Waiting on a certificate for a customer? Speak to an Expert about the right level and timeline for your organisation.
Jennifer Goulbourne
Jennifer is a Digital Marketing Executive at OmniCyber Security, where she's responsible for engaging the company's existing customer base across digital channels and creating helpful resources on threat intelligence and security operations for cybersecurity professionals and business leaders.
