Security

Cyber Essentials in 2026: the baseline every UK supplier needs

Sam Whitaker·Principal Engineer·6 min

If you want to work with UK government or larger enterprises, at some point a security questionnaire lands in your inbox. Cyber Essentials — the UK's baseline scheme — is where most of them start.

We build to the Cyber Essentials controls as standard and are working towards certification. Even before a certificate is on the wall, the controls are simply good engineering hygiene, and they're worth adopting now.

The five control areas, in plain terms

  • Firewalls and secure configuration: no default passwords, no unnecessary open ports, sensible boundaries around every service.
  • Access control: least privilege, unique accounts, and multi-factor authentication everywhere that matters.
  • Malware protection: managed endpoints and a locked-down software supply chain.
  • Security update management: patch quickly and predictably; unsupported software gets retired, not nursed.

    • Why it matters commercially

    For public-sector procurement in particular, a supplier who can evidence these controls clears a hurdle that stops a lot of competitors dead. It signals you take other people's data as seriously as your own — which, for the sectors we work in, is the whole game.

    Our stance

    We don't claim certifications we don't hold, and we won't pad a proposal with badges. What we will do is build to the baseline on every project, complete your security questionnaires honestly, and tell you plainly where we are on the certification roadmap. Trust is easier to keep than to rebuild.

    Ready when you are

    Let's build something that lasts.

    Book a free 30-minute call with a senior engineer. No sales pitch — just an honest view on whether we're a fit.

    Book a 30-min callSee our work