A decade of Cyber Essentials: the journey towards a safer digital future

On 23 October 2024, the House of Lords was buzzing with excitement as industry leaders, government officials, and cyber security enthusiasts gathered to celebrate a significant milestone: the 10th anniversary of the Cyber Essentials scheme. The event marked a decade of progress in bolstering the UK’s cyber defences and fostering a culture of cyber security awareness.

A look back at the beginning

Launched in 2014, Cyber Essentials was born out of a pressing need to protect businesses and organisations from the growing threat of cyber attacks. CESG (a forerunner to the NCSC) had been investigating attacks against several large organisations. Whilst we judged that each had been perpetrated by a capable actor, the techniques used were not cutting-edge. Our analysis showed that one or more of just five key technical controls would have stopped the attacks from progressing. We then worked with industry to put a repeatable assurance wrapper around those controls, and thus the Cyber Essentials certification scheme was born.

Over the years, it has evolved into a cornerstone of the UK’s cyber security strategy, helping thousands of businesses enhance their digital resilience. However, the basic control set still remains the same; this is because we know that time and time again, even sophisticated attackers exploit basic vulnerabilities.

Significant milestones over the years

As we reflect on the past decade, several key milestones stand out:

• 2014: The launch - Cyber Essentials officially launched. The scheme soon became required for certain UK government contracts that handle sensitive and personal information.  
• 2016: First major update - This revision aimed to address emerging threats and incorporate feedback from early adopters, ensuring the scheme remained relevant and effective. 
• 2019: Over 50,000 total certifications - shows growing popularity and increasing awareness of cyber security among UK businesses. 
• 2020: A new delivery model - IASME is appointed as the NCSC’s Cyber Essentials Delivery Partner. 
• 2022: 100,000th certificate issued – with over 30,000 certificates now being awarded annually.
• 2023: Need help to become certified - the Cyber Advisor scheme is launched, offering small organisations NCSC assured advice and practical help to implement the Cyber Essentials controls 
• 2024: 10-year anniversary - the Cyber Essentials Knowledge Hub is launched. Nearly 190,000 certificates have been issued, to date.  

The 10-year anniversary event

The anniversary event was a fitting tribute to the success of Cyber Essentials. Attendees were treated to insightful speeches, panel discussions, and networking opportunities. Cyber security Minister, Feryal Clark delivered a keynote address, emphasising the scheme’s role in making the UK more cyber resilient.

One of the highlights of the event was a joint statement by the NCSC and the UK’s leading banks including Barclays, Natwest, TSB, Nationwide, Lloyds Banking Group, and Santander UK. This collaboration aims to enhance cyber security across critical national supply chains by promoting the adoption of Cyber Essentials.

The impact of Cyber Essentials

Over the past decade, Cyber Essentials has had a profound impact on the UK’s cyber security landscape. Data from the provider of the free cyber insurance that comes with Cyber Essentials certification, tells us that organisations with Cyber Essentials certification are 92% less likely to make a cyber insurance claim compared to those without it. This statistic underscores the scheme’s effectiveness in mitigating cyber risks.

Moreover, Cyber Essentials has played a crucial role in raising awareness about cyber security. An evaluation conducted as part of the 10-year review revealed that 85% of certified organisations reported a better understanding of cyber risks. This increased awareness has empowered businesses to take proactive measures in safeguarding their digital assets.

Additionally, the scheme through its operating model, has created a thriving ecosystem of cyber security companies who offer advice and certification right across the UK. Over 10 years we’ve seen it grow from a handful of companies to over 360 Certification Bodies and just short of 1,000 Assessors adding value to the economy by providing employment and upskilling opportunities.

Looking ahead

The evolving cyber threat landscape means that the scheme must continue to adapt and innovate.

The introduction of the Cyber Security and Resilience Bill is a step in this direction, aiming to further enhance the UK’s cyber defences. However, as the Minister said in her speech, “the proposed legislation must be complemented by other efforts to improve cyber security across the wider economy.” This is why the NCSC, in partnership with IASME is continuing its proof of concept for Cyber Essentials “Pathways”, an alternative route to certification for large organisations. This includes the scheme being increasingly used as a tool for supply chain security.

The success of Cyber Essentials over the past decade is a testament to the collective efforts of the government, industry partners, and the countless organisations that have embraced the scheme. In particular, I’d like to recognise our network of incredible Certification Bodies and Cyber Advisors without whom, we wouldn’t have a scheme. As we move forward, the goal remains clear: to create a safer digital environment for all.

So, here’s to another decade of progress, innovation, and resilience in the face of ever-evolving cyber threats.

Anne W
Head of NCSC Industry Assurance