---
title: "UK Cyber Essentials for small SaaS teams: a practical guide"
canonical: "https://auditbadger.com/blog/uk-cyber-essentials-for-small-saas-teams-a-practical-guide/"
last-updated: "2026-10-05"
---

# UK Cyber Essentials for small SaaS teams: a practical guide

By Maciej • Published 2026-10-28 • 8 min read • Categories: Compliance Governance, Certification, Knowledge Hub

Created with AI assistance. AuditBadger retains editorial control and responsibility.

**TL;DR:** Cyber Essentials is the UK government's baseline scheme, run by the NCSC and delivered by IASME through licensed Certification Bodies: you answer a self-assessment on five technical controls (firewalls, secure configuration, security update management, user access control, malware protection) and a Certification Body certifies you, while Cyber Essentials Plus adds independent technical testing. The current rules are the NCSC's Requirements for IT Infrastructure v3.3 with IASME's Danzell question set, used for assessments started from 27 April 2026. For SaaS teams the key points are scope and precision: cloud services that hold your data cannot be excluded, end-user devices, home workers and BYOD are in, authentication to cloud services must always use MFA, critical and high-risk updates (CVSS 7 or above) must be installed within 14 days, and devices must lock after no more than 10 failed attempts. UK central government requires it for contracts involving personal data or OFFICIAL-level ICT, renewed annually. Much of the work overlaps with ISO 27001 and SOC 2, so the practical order is: define and agree scope, read the question set, fix MFA, fix patching, verify device controls, then answer with evidence in hand.

Cyber Essentials is the UK government's baseline security scheme: five technical controls, a self-assessment questionnaire, and a certificate issued by an IASME-licensed Certification Body. For a small SaaS team the honest summary is this. It is smaller than ISO 27001 or SOC 2®, it is mostly about your laptops and your cloud accounts rather than your product, and the part that catches SaaS companies out is scope: every cloud service that holds your data is in it, no exceptions.

Here is what it actually asks, what changed in 2026, and the order we would tackle it in.

## What is Cyber Essentials, in one paragraph?

It is a scheme run by the NCSC (the UK's National Cyber Security Centre) and delivered by IASME, its official delivery partner, through a network of Certification Bodies. You answer a self-assessment questionnaire about five technical control themes, a Certification Body reviews your answers, and if they hold up you get certified. The current rulebook is the NCSC's _Requirements for IT Infrastructure v3.3_, and the matching IASME question set is called Danzell. It applies to assessments started on or after 27 April 2026.

Cyber Essentials Plus uses the same five controls and adds independent technical testing of your systems, so an assessor checks that the controls work in practice instead of taking your word for it. The NCSC describes the basic level as baseline assurance and Plus as higher assurance. The usual path for a small team is the basic certificate first, then Plus when a buyer or contract asks for it.

## Who actually needs it?

Two groups, mostly.

First, anyone selling into UK central government. Under the government's procurement policy note on Cyber Essentials (PPN 014, which replaced PPN 09/14 in 2025), central government departments, their executive agencies, non-departmental public bodies and NHS bodies include it in contracts where a supplier handles citizens' personal data, government staff data, or ICT systems processing information at OFFICIAL level. Where it is required, it must be renewed annually for the life of the contract.

Second, UK buyers who borrowed the idea. The NCSC puts it plainly: a growing number of organisations require suppliers to be certified to bid for work. If a UK prospect's supplier questionnaire has a Cyber Essentials checkbox, that is usually why.

If neither applies to you, it is still a decent forcing function for the basics. But do not chase it just to have a badge.

## What are the five controls?

The requirements are organised under five themes. Here is each one, translated into SaaS-team terms.

### 1. Firewalls

Every in-scope device needs a correctly configured firewall. For a remote team that usually means the operating system's built-in software firewall switched on, because home routers you did not supply are out of scope. Default admin passwords on any firewall or router get changed, admin interfaces are not reachable from the internet (unless protected by MFA or an IP allow list), unauthenticated inbound connections are blocked by default, and inbound rules are documented and approved. For cloud infrastructure, the same thinking applies to security groups and network rules.

### 2. Secure configuration

Remove software and accounts you do not use, change default or guessable passwords, disable auto-run, and make sure devices lock. Device unlocking needs a biometric, password or PIN, protected against brute force: no more than 10 guesses in 5 minutes, or lock after no more than 10 failed attempts. A PIN that only unlocks the device must be at least 6 characters.

### 3. Security update management

Software in scope must be licensed and supported, and removed when it stops being supported. Critical and high-risk updates (CVSS v3 base score of 7 or above) must be installed within 14 days of release. The Danzell question set treats timely installation of those updates as a pass-or-fail item, so "we patch when we get round to it" is no longer an answer.

### 4. User access control

You control who has which accounts, admin work happens on separate admin accounts, and MFA is on wherever it is available. For cloud services the wording is blunt: authentication to cloud services must always use MFA. This is where a lot of SaaS teams already have the work done, especially if you run [access reviews](/blog/user-access-reviews-auditors-accept-with-a-template/) for another framework.

### 5. Malware protection

Every in-scope device needs an active malware protection mechanism: anti-malware software configured to block malicious code and malicious websites (on Windows and macOS), or application allow listing where only approved, code-signed applications can run. Built-in protection in modern operating systems usually counts, as long as it is on and up to date.

## What does the scope look like for a SaaS company?

This is the part people get wrong, so it is worth slowing down.

- **Cloud services cannot be excluded.** v3.3 says it outright: if your organisation's data or services are hosted on cloud services, those services must be in scope. That covers your IaaS and PaaS (think AWS or Azure) and your SaaS tools (think Google Workspace or Microsoft 365).
- **End-user devices must be in.** A scope that leaves out laptops and phones is not acceptable.
- **Home workers are in.** Company or personal devices used for work from home are in scope by default.
- **BYOD is in.** Personal devices that access organisational data or services count, except phones used only for calls, texts or MFA apps.
- **Contractors' own devices are out** , but every account your organisation owns is in, even when a contractor or managed service provider uses it.
- **Bespoke parts of your own web application are out.** Custom code you write is out of scope by default; the NCSC points you to its Software Security Code of Practice for that.

For cloud services the NCSC splits responsibility by service type. On SaaS the provider handles firewalls, patching and malware protection, but user access control is always yours. On IaaS most controls are shared. Where you rely on the provider, you need it committed in writing, which in practice means their security documentation and shared responsibility model. Your [vendor reviews](/blog/vendor-reviews-by-vendor-type-what-to-ask-each-one/) are where that paper trail lives.

Practically, scoping is an inventory job. If you already keep an [asset register that survives audits](/blog/iso-27001-asset-inventory-a-5-9-a-5-11-an-asset-register-that-survives-audits/), you are most of the way there. If you do not, start with a list of devices, cloud accounts and SaaS tools that touch company data. The NCSC notes that asset management is not one of the five controls, but it helps you meet all of them.

## How much of it do you already have from ISO 27001 or SOC 2?

A fair amount, if you have done either. MFA, access reviews, patching cadence, device encryption and screen lock, malware protection and an asset inventory all show up in ISO 27001 Annex A and in the SOC 2 common criteria. We went through that overlap in more detail in [SOC 2, ISO 27001, NIS2 and the AI Act: what actually overlaps](/blog/soc-2-iso-27001-nis2-ai-act-what-actually-overlaps/).

What is different is the shape. Cyber Essentials does not ask you to run a management system or prove a control operated over a period. It asks precise, binary questions at a point in time. Ten failed unlock attempts. Fourteen days to patch. MFA on every cloud service. The work is less, but there is less room for "mostly".

## The order we would do it in

1. Write down the scope: devices (company and BYOD), cloud infrastructure, SaaS tools, admin accounts. Agree it with your Certification Body before you start the questionnaire.
2. Download the Danzell question set from IASME and read it once end to end before answering anything.
3. Fix MFA first. Every cloud service, every user. It is usually the quickest gap to close.
4. Check patching on every device and remove unsupported software.
5. Turn on and verify device lock, disk encryption, firewalls and malware protection. If you use a device management tool, pull the evidence from there rather than asking people for screenshots.
6. Answer the questionnaire with evidence in hand, not from memory.

## Where AuditBadger fits

We added UK Cyber Essentials v3.3 as a framework in September ([changelog](/changelog/2026-09-07/)). You set up a project covering scope and assets, firewalls, secure configuration, security updates, user access control and malware protection, and work you have already done for ISO 27001 or SOC 2 can be reused as supporting evidence instead of collected twice. Automated checks against your connected cloud accounts (and devices, if you connect FleetDM) run monthly, plus on demand.

To be precise about the boundary: AuditBadger helps you prepare the self-assessment and the evidence behind it. The certificate itself comes from an IASME-licensed Certification Body, and you answer to them, not to us. For context, our own SOC 2® Type II observation window ran from 27 March to 27 June 2026, on AuditBadger, with no external consultants, and much of that work (MFA, patching, device controls, an asset inventory) is exactly what Cyber Essentials leans on.

If you are juggling Cyber Essentials alongside another framework, see how projects and controls fit together on the [compliance management](/features/compliance-management/) page.