Cyber Essentials for UK Software Companies — The 5 Controls Explained (2025)

Cyber Essentials is mandatory for any UK business bidding for central government contracts that involve handling personal information or sensitive data (as defined by the Cabinet Office). It is also required for suppliers to the NHS, MOD, and many local authorities. Beyond mandates, many large enterprises now require Cyber Essentials from their software suppliers as part of vendor onboarding — making it a de facto commercial requirement in regulated sectors.

ISO 27001 is a comprehensive information security management system covering 114 controls across strategy, processes, people, and technology. Cyber Essentials is narrower — five specific technical controls — but is government-mandated and UK-specific. The two are complementary: Cyber Essentials provides a technical baseline; ISO 27001 builds on it with broader organisational controls. For most UK SMBs, Cyber Essentials should come first (simpler, faster, required for gov contracts). ISO 27001 makes sense when you need to demonstrate the full ISMS to enterprise or regulated sector buyers.

Your cloud infrastructure (AWS, Azure) is in scope for Cyber Essentials if it hosts software that: processes personal data, connects to your internal network, or is internet-accessible. This means: cloud security groups (acting as firewalls), IAM permissions (access control), container image scanning (malware protection), and patch management for cloud services all fall under the five controls. ClickMasters designs cloud architectures to be CE-compliant from the outset.

Cyber Essentials Basic: 1–3 days. Complete the self-assessment questionnaire, submit to a certification body (e.g. IASME, Cyber Essentials Company), receive certification. Cyber Essentials Plus: 1–3 weeks. Includes external vulnerability scanning and sample testing. For software companies undergoing certification for the first time, ClickMasters recommends a pre-assessment review (half a day) to identify any controls gaps before formal submission — avoiding a failed submission.