Steps to Implement NCSC Cyber Essentials for UK SaaS Companies: Framework Gold

Cyber Essentials is the most cost-effective security credential a UK SaaS company can hold, and it is routinely misunderstood. Founders assume it is either a rubber stamp or a full-blown audit. It is neither. It is a focused, government-backed scheme that verifies five technical controls known to stop the overwhelming majority of common internet attacks. Get it right and you unlock public sector contracts, shorten enterprise vendor reviews, and build a foundation you can extend into SOC 2 or ISO 27001 later. Get it wrong and you fail the assessment on avoidable detail. This guide walks through exactly what the scheme covers and how to implement it without wasted effort.

What Cyber Essentials is and why it matters for SaaS

Cyber Essentials is a UK National Cyber Security Centre scheme, delivered through IASME, that certifies an organisation against five core technical controls. There are two levels:

• Cyber Essentials: a self-assessment questionnaire verified by a certification body. You attest to your controls and answer detailed technical questions.
• Cyber Essentials Plus: everything in the base scheme, plus a hands-on technical audit where an assessor independently tests your systems, including internal and external vulnerability scans and a check of your workstation configuration.

For a SaaS company, this matters for three reasons. First, Cyber Essentials is a mandatory requirement for many UK government and public sector contracts that involve handling certain data or providing certain services. Second, private enterprise buyers increasingly ask for it as a baseline in vendor security questionnaires. Third, it forces you to fix the exact weaknesses that lead to the breaches most likely to hit a growing company: unpatched systems, default credentials, over-permissioned accounts, and unmanaged devices.

The five controls you must implement

Everything in Cyber Essentials comes back to five control areas. Understanding what each one actually requires, not the headline label, is the difference between passing first time and getting bounced.

Control	What it requires	Where SaaS teams slip up
Firewalls	Boundary protection on every device and network, with default admin passwords changed and inbound rules justified	Cloud security groups left wide open; home-worker devices with no host firewall
Secure configuration	Remove or disable unnecessary accounts, software, and services; change default settings	Default installs, unused accounts, sample content left enabled
Security update management	Apply critical and high-severity patches within 14 days; run only supported software	End-of-life operating systems; unpatched third-party apps and libraries
User access control	Unique accounts, least privilege, separate admin accounts, MFA on cloud services	Shared logins; developers holding standing admin they rarely need
Malware protection	Anti-malware, application allowlisting, or sandboxing on in-scope devices	Servers and Linux endpoints assumed exempt; BYOD ignored

Two of these deserve extra attention because they cause the most failures. Security update management is strict: fourteen days for critical and high-severity fixes, and absolutely no unsupported software in scope. If you are still running an end-of-life operating system anywhere in scope, you will fail. User access control now explicitly requires MFA on your cloud services, and assessors check that admin accounts are separate from everyday accounts used for email and browsing.

Defining your scope correctly

Scope is where most first attempts go wrong. Cyber Essentials assesses the boundary of your organisation's IT, and for a SaaS company that boundary is not obvious. You need to decide what is in scope with care, because an over-broad scope creates unnecessary work and an under-declared scope invalidates your certificate.

• Corporate devices: every laptop, desktop, and mobile that accesses organisational data or services is in scope, including remote and home-working devices. This is non-negotiable and catches people out.
• Cloud services: the scheme covers your use of IaaS, PaaS, and SaaS. You are responsible for the parts you configure: identity, access control, security group rules, and MFA on the administrative interfaces.
• BYOD: personal devices that access organisational data are in scope for user access control and, in many cases, other controls too. Decide your BYOD policy before you assess, not after.

You can certify a well-defined subset of your organisation, but a "whole organisation" certificate is more valuable to buyers and avoids awkward questions in security reviews. Getting the scope statement right is genuinely the highest-leverage decision in the whole process. If your platform runs across multiple cloud accounts, mapping shared-responsibility boundaries is exactly where a cloud security consulting engagement removes ambiguity.

Step by step: from decision to certificate

Step 1: Choose your level

Start with base Cyber Essentials if you have never certified, unless a contract explicitly demands Plus now. Many companies do base first, remediate anything it surfaces, then move to Plus within the same certification year when the technical audit is far more likely to pass cleanly.

Step 2: Run a gap assessment against the five controls

Before you touch the official questionnaire, honestly map your current state against each control. The most common gaps are unsupported software, missing MFA on a cloud admin console, standing admin privileges, and unmanaged home-working devices. A structured IT security audit at this stage finds the failures an assessor would find, while you still have time to fix them cheaply.

Step 3: Remediate

Work the gaps in order of certification risk:

1. Retire or replace any end-of-life software and operating systems in scope.
2. Enforce MFA on all cloud services, especially administrative interfaces.
3. Separate admin accounts from daily-use accounts and remove standing privileges.
4. Establish and document a 14-day patch process for critical and high-severity updates.
5. Confirm firewall and secure-configuration baselines on every in-scope device, including home workers.

Step 4: Complete the questionnaire and submit

Answer the questionnaire precisely and truthfully. Assessors look for specificity. "We patch regularly" is weaker than "critical and high-severity patches are applied within 14 days via automated deployment, verified weekly." Vague answers invite follow-up questions or a fail.

Step 5: For Plus, pass the technical audit

Cyber Essentials Plus adds independent vulnerability scanning and a workstation configuration check. Run your own internal and external scans first and remediate the findings. A quick vulnerability assessment before the official audit means the assessor confirms a clean environment rather than handing you a list of failures.

Step 6: Maintain and recertify

Certification lasts twelve months. Treat the controls as ongoing operations, not a once-a-year scramble. Configuration drifts, new starters get over-provisioned, and unsupported software creeps back in. Build the five controls into your standard operating rhythm so recertification is a formality.

Cyber Essentials, SOC 2, and ISO 27001

UK SaaS companies selling internationally often need more than Cyber Essentials. The good news is that the work compounds. The technical controls in Cyber Essentials, patching, MFA, access control, secure configuration, malware protection, map directly onto SOC 2 Common Criteria and ISO 27001 Annex A. Do Cyber Essentials with evidence and documentation in mind and you have started the groundwork for SOC 2 and ISO 27001 readiness.

Aspect	Cyber Essentials	Cyber Essentials Plus	SOC 2 / ISO 27001
Assessment	Verified self-assessment	Independent technical audit	Full external audit / certification
Effort	Weeks	Weeks plus scan remediation	Months
Primary buyer signal	UK baseline credibility	Verified UK assurance	Global enterprise assurance
Best for	Early-stage SaaS, public sector entry	Contracts requiring verified controls	Selling to US and global enterprise

My recommendation for most UK SaaS founders: get Cyber Essentials early because it is cheap and fast, use it to win UK and public-sector deals, then layer SOC 2 or ISO 27001 when your buyer base demands it. Sequencing this way means each framework reuses the evidence from the last.

Common reasons UK SaaS companies fail

• Unsupported software in scope. The single most common hard fail. Inventory everything and retire end-of-life systems before you assess.
• Home-working devices ignored. Remote and BYOD devices are in scope. Pretending they are not will invalidate the certificate.
• MFA gaps on cloud admin consoles. The most privileged interfaces are exactly where assessors look.
• Standing admin privileges. Developers holding permanent admin they rarely use breaks the least-privilege requirement.
• Treating it as a one-off. Controls decay. Without an operating rhythm you will scramble at recertification.

How Atlant Security helps

We run a gap assessment against all five controls, tell you honestly what will fail and why, and build a remediation plan sized to your team. For Cyber Essentials Plus we run pre-audit vulnerability scans so the official assessment confirms a clean result rather than surfacing surprises. Where you want ongoing ownership of the controls and help handling buyer security reviews, our virtual CISO services give you an experienced security lead without a full-time hire. If you are targeting UK public sector or enterprise contracts, contact us to scope your certification.

Frequently Asked Questions

How long does Cyber Essentials take to achieve?

If your controls are already close, base Cyber Essentials can be completed in one to two weeks. Realistically, most SaaS companies need three to six weeks to remediate gaps such as unsupported software or missing MFA first. Cyber Essentials Plus adds time for the technical audit and any scan remediation.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Base Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus covers the same five controls but adds an independent technical audit, including vulnerability scans and a workstation configuration check performed by an assessor. Plus gives buyers stronger assurance because the controls are independently tested.

Do our cloud services count as in scope?

Yes. Your use of IaaS, PaaS, and SaaS is in scope for the parts you control: identity, access management, firewall and security group configuration, and MFA on administrative interfaces. The cloud provider secures the underlying platform, but your configuration of it is assessed.

Is Cyber Essentials enough to sell to enterprise customers?

It is an excellent baseline and often enough for UK public sector and smaller enterprise deals. Larger enterprises and US buyers usually want SOC 2 or ISO 27001. Because the technical controls overlap heavily, Cyber Essentials is a strong first step that makes the later frameworks faster to achieve.

How often do we need to recertify?

Cyber Essentials certification is valid for twelve months, after which you recertify. Treat the five controls as continuous operations rather than an annual event so that configuration drift, new accounts, and unsupported software do not creep back in and cause a recertification failure.