Is Cyber Essentials required?

It’s mandatory for many UK central government contracts that handle personal data or certain ICT services, and increasingly requested in supply chains.

Cyber Essentials

Cyber Essentials Plus and penetration testing

Cyber Essentials is the UK government-backed baseline. It’s valuable — but it isn’t a penetration test of your web application.

Request my free AI pentest

£0 · no payment details · no obligation

What Cyber Essentials covers

Firewalls and boundary devices
Secure configuration
User access control
Malware protection
Security update management

What Plus adds

Cyber Essentials Plus includes a hands-on technical audit, including external vulnerability scanning and checks on sample devices, by an assessor.

What it doesn’t cover

Neither level tests the business logic of your web application — whether customers can see each other’s data, or whether your AI chatbot can be manipulated. That’s what a penetration test is for.

Penetration testing for SOC 2
Penetration testing for ISO 27001
Penetration testing for PCI DSS
Penetration testing for DORA

All testing services →

Common questions

Ready to get started?