Cyber Essentials in 2026: check which rules your application uses

Understand what the certificate covers

Cyber Essentials checks a set of basic technical protections. These include controlling access, keeping software updated and protecting devices against common threats.

It has two levels, Cyber Essentials and Cyber Essentials Plus. Ask the official certification body or your adviser to explain the level the school is considering.

A certificate covers the agreed organisation and systems in the assessment. It is not a promise that every possible incident has been prevented.

Check the application date and version

The official scheme information sets out version 3.3 requirements from 27 April 2026. Applications begun under earlier arrangements may have different applicable terms.

Confirm the requirements for your particular application with the certification body. Check the current official information before starting, rather than using an older checklist because it is familiar.

Ask what deadlines and evidence the application needs.

Give the questions to the right people

IT should check technical facts about the actual devices and services included. The school contact can coordinate the application, find contracts and help confirm which equipment is in use.

Avoid guessing an answer simply to finish a form. If a device or service is unclear, record the question and ask the responsible supplier.

A school business manager does not need to become a technician to coordinate this work.

Plan any fixes before submission

Ask IT to explain outstanding work, its cost and whether it interrupts teaching or office tasks. Use the school's normal approval process.

Agree who will check completion and who is authorised to submit the application. Keep the accepted requirements and relevant records in the approved place.

The helpful starting point is a clear version, a clear list of systems and technical answers checked by the people responsible for them.