Cyber Essentials Explained for NZ Businesses

For a New Zealand business, the controls can provide a useful reference for improving everyday security. Whether you need certification depends on your customers, contracts and assurance requirements. Using the controls is different from holding a current certificate.

This guide explains what the scheme is, when it matters to a New Zealand business, what the five controls require under the current version, how the two certification levels differ, and what the scheme leaves out. It is written for business owners and managers deciding whether the scheme is relevant to them, and what work it would involve.

What is Cyber Essentials?

It is a certification scheme backed by the UK Government and overseen by the UK National Cyber Security Centre. The UK NCSC describes it as the minimum standard of cyber security it recommends for organisations of all sizes. Certification is delivered by IASME through a network of certification bodies, which assess applications against the published requirements.

The scheme is deliberately narrow. It does not try to cover every threat or every part of running a secure business. It focuses on five technical controls that help protect against common attacks carried out over the internet, such as attackers exploiting an unpatched system, a default password or an account with more access than it needs.

The UK NCSC’s Cyber Essentials overview explains the scheme and the two certification levels. The scheme is not a New Zealand government certification, and it is separate from the guidance issued by New Zealand’s National Cyber Security Centre.

Where does it sit alongside other standards?

The scheme sets a technical baseline rather than a complete security programme. Broader standards such as ISO 27001 cover governance, risk management and process in far more depth. For a smaller business, the five controls can be a practical place to start, and the work carries over if you later move towards a fuller standard.

Is Cyber Essentials relevant to New Zealand businesses?

Yes, particularly when a customer or contract asks for it. Before committing to certification, confirm which level is required and what systems and legal entities must be covered. If your immediate goal is stronger security, the controls can help identify practical work even where certification is not required.

Cyber Essentials is a UK scheme, separate from guidance issued by New Zealand’s National Cyber Security Centre. Choose your security approach around your risks and obligations, rather than assuming one overseas certificate covers every requirement.

When does certification come up?

• UK customers or partners. A UK organisation you supply may ask for either certification level as part of its supplier checks.
• Tenders. Some tenders ask for a recognised certification or evidence of specific controls. Read what the tender actually asks for before deciding.
• Customer security questionnaires. A customer may accept evidence of the controls without a certificate, or may require the certificate itself.
• Your own baseline. Some businesses use the controls as a checklist for their own security work, with no plan to certify.

What about New Zealand policy?

New Zealand’s Department of the Prime Minister and Cabinet consulted on strengthening the resilience of critical infrastructure. That consultation ran from 27 February to 19 April 2026, and the submissions will inform further advice to Cabinet. The consultation does not establish a requirement for New Zealand businesses to hold this certificate, and adopting the UK scheme should not be presented as meeting any emerging New Zealand obligation.

What about insurance and tenders?

Whether a certificate is required or accepted depends on the customer, tender or insurer. A certificate does not guarantee tender eligibility, a lower premium or regulatory compliance. In the UK, the scheme includes a cyber liability insurance offer for eligible UK organisations that certify their whole organisation, subject to conditions such as turnover. That offer should not be treated as a benefit available to a New Zealand business. Our guide to cyber insurance explains the questions New Zealand insurers ask about controls.

What are the five Cyber Essentials controls?

The five controls each cover a different route into a business. The summary below reflects the current requirements, but it is not a complete certification checklist. The official wording and your certification body’s scope requirements decide what certification needs.

Firewalls

Firewalls control the connections between your devices and the internet. The scheme expects a boundary firewall to protect the network, and software firewalls to protect devices used on untrusted networks, such as public Wi-Fi. Firewalls should block unauthenticated inbound connections by default, with any approved rules documented. Which firewalls you need depends on how your network and devices are set up, so the requirement is not simply one hardware and one software firewall in every case. Our managed firewall service covers the boundary side.

Secure configuration

Devices and software arrive with default settings designed for convenience. Secure configuration means removing or disabling accounts and software you do not need, changing default passwords, turning off features that run content automatically, and making sure devices lock when they are left unattended.

Security update management

Software in scope must be licensed and supported by the vendor, and updates that fix serious vulnerabilities must be applied promptly. Under the current requirements, updates that qualify must be installed within 14 days of release. That includes updates the vendor describes as critical or high risk, those fixing vulnerabilities with a CVSS v3 score of 7 or above, and updates where the vendor gives no severity details. Faster action may be needed when a vulnerability is being actively exploited.

Software that no longer receives security updates needs to be upgraded, replaced or removed from scope. Unsupported software is a different problem from old hardware: upgrading the operating system can sometimes resolve a support issue without replacing the device. Our guide to hardware lifecycle planning covers how to plan replacements.

User access control

User access control means people only have the access their job needs. In practice that covers approving new accounts, applying least privilege, keeping administrator accounts separate from everyday accounts, and removing access promptly when someone leaves or changes role.

Multi-factor authentication is part of this control. The current scheme requires multi-factor authentication for cloud services wherever it is available, including where it is only offered as a paid option, and a missing requirement here can fail an assessment. Our guide explains how to roll out multi-factor authentication.

Malware protection

Malware protection aims to stop malicious software from running. The scheme accepts anti-malware software or application allow-listing, which only lets approved applications run. Whichever approach you use, it needs to be active and current on every device in scope.

What changed in Cyber Essentials in April 2026?

The current version is set out in the official Cyber Essentials requirements for IT infrastructure v3.3, which took effect in April 2026. IASME summarises the April 2026 changes, which apply from 26 April 2026 with a new question set.

• Multi-factor authentication. Not having multi-factor authentication on cloud services where it is available is now an automatic fail.
• Security updates. Questions on installing high-risk and critical updates within 14 days are also automatic fail items.
• Scope descriptions. Applicants describe their scope in more detail, document what is out of scope and identify the legal entities covered.
• Cloud services. The definition of a cloud service has been clarified.

If you assessed your business against an older version of the requirements, check your answers against the current requirements before applying.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

There are three different things a business might mean when it talks about the scheme, and only two of them lead to a certificate.

Plus builds on the basic certification, so a business needs that first. Certification is valid for 12 months and needs renewing to stay current. A general security audit or readiness review is not, by itself, either form of certification.

How does certification work?

IASME sets out the certification process: prepare against the requirements, purchase an assessment, complete the self-assessment questions, have the answers reviewed by a certification body, and receive the certificate if the answers meet the standard. The self-assessment is signed off by a board member or equivalent senior person, who confirms that the answers are accurate. For Plus, an assessor then carries out a technical audit of the systems in scope.

How do the controls map to tools you already use?

Many of the controls can be met with systems you already run, which means the work can be configuration and management rather than buying new products. The detail depends on the products, licences and settings you have.

Microsoft 365 and cloud services

In Microsoft 365, multi-factor authentication and Conditional Access can enforce how people sign in. They do not cover access management on their own: account approval, least privilege, separate administrator accounts and prompt removal of access still need a process. Microsoft’s security products vary by licence, so check which email and device protection you actually have and how it is configured, rather than assuming one product covers everything.

Devices and endpoint management

Endpoint management tools such as Microsoft Intune can apply configuration, update and malware protection settings across a fleet, including devices used at home. That central control makes it easier to show that the controls apply to every device in scope, not just the ones in the office.

How do you prepare for Cyber Essentials?

Preparation is a sequence of decisions and checks. The order matters, because scope and level shape everything that follows.

A readiness review against the controls is useful preparation, but it is not certification. Our security audit can review the agreed controls across your environment and show where the gaps are.

An illustrative example

Consider an illustrative 30-person professional services firm with two offices, company laptops, a few personal phones used for email and Microsoft 365. A customer asks for certification. The firm first confirms that the customer needs the basic certification covering the whole business. Scoping shows that the personal phones are in scope because they access business email.

The review then finds that multi-factor authentication is on for the directors but not for all staff, that two former employees still have active accounts, and that one laptop runs an operating system version that no longer receives updates. Each gap is addressed in order of risk: multi-factor authentication for everyone, the old accounts removed, and the unsupported operating system upgraded, which in this example does not need a new laptop. Only once the controls are in place does the firm apply. This is an example, not a typical timeline or cost.

How much does Cyber Essentials cost?

There are three separate costs to plan for, and they come from different places.

• Assessment fee. The certification fee is set by the scheme and varies with the size of the organisation. Plus is quoted separately because it includes technical testing. Check the current fees on the IASME website rather than relying on a converted figure.
• Preparation and remediation. The work to close gaps, such as configuring multi-factor authentication or replacing unsupported software. This depends on your starting point and scope.
• Ongoing management. Keeping the controls in place through the year so the business is ready to renew. Devices, staff and software all change over 12 months.

The certification fee and any implementation work from Exodesk are different costs. We quote implementation once we understand the scope and the level you need.

What does Cyber Essentials leave out?

The five controls are a technical baseline, not a complete security programme. Your business still needs suitable recovery arrangements, staff training, incident response and ongoing risk management. The current requirements document encourages backups, but backup and recovery are not one of the five assessed control areas.

• Backup and recovery. A tested backup and restore routine matters even though the scheme does not assess it.
• Staff awareness. Technical controls help, but people still need to recognise and report suspicious requests. Security awareness training sits alongside the controls.
• Incident response. The scheme does not cover what happens when something goes wrong. An incident response plan fills that gap.
• Risk management. Deciding which risks matter to your business, and reviewing them as things change, sits outside the five controls.

Holding the certificate does not prove a business is safe. It shows that a defined set of technical controls was in place for the scope assessed at the time of certification.

Cyber Essentials support from Exodesk

Exodesk can help review and improve the technical controls your business relies on, including configuration, access, patching and malware protection. If a customer has asked for Cyber Essentials certification, tell us which level and scope they require so we can discuss the implementation work needed. Formal certification is a separate scheme process.

Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. See our cyber security services for help putting the controls in place.

Contact us or call 0800 396 337 to talk about the Cyber Essentials controls you need.