Cyber Essentials compliance software for your self-assessment evidence

Compliance has a Cyber Essentials catalog. It holds the technical controls as requirements: firewalls, secure configuration, security update management, user access control and malware protection.

The catalog marks these controls as mandatory, so you can't exclude them in the Applicability view.

The catalog also holds the Cyber Essentials Plus tests, an external vulnerability test and an internal authenticated test, as optional requirements. If you don't go for Plus, you mark them not applicable with a justification. Mark both tests the same way.

The requirement texts are summaries in plain language, not the NCSC wording. For the official text, the catalog points you to the NCSC document "Cyber Essentials: Requirements for IT Infrastructure". Dutch versions of the summaries exist.

When you adopt Cyber Essentials, each mandatory requirement gets an owner, the status Planned and a recurring review. Compliance also creates yearly schedules for the internal audit, the external audit and the management review of Cyber Essentials. You can change how often each one runs and who owns it.

A Cyber Essentials certificate expires after 12 months, according to IASME, and IASME emails you a renewal reminder about a month before. Compliance has no renewal schedule for Cyber Essentials.

Compliance does not certify your organisation. IASME or a Certification Body licensed by IASME assesses your answers and issues the certificate. Compliance is where you keep the evidence and records behind those answers.

According to NCSC, Cyber Essentials is a verified self-assessment. You register with IASME, answer the questions, and someone at board level signs off your answers before an assessor marks them. You can also hire a Certification Body licensed by IASME to assess you. IASME says Cyber Essentials Plus uses the same controls and adds a technical audit of your systems.

NCSC's current requirements are version 3.3, in effect from 27 April 2026. Under them, cloud services can't be excluded from scope. IASME says that missing MFA on a cloud service where MFA is available is an automatic fail, and so is not installing high risk or critical updates within 14 days.

In UK government buying, the Cabinet Office's PPN 014 of 17 February 2025 replaced PPN 09/14 and PPN 09/23. It covers central government departments, their executive agencies, non departmental public bodies and NHS bodies. Those bodies ask for Cyber Essentials or Cyber Essentials Plus, or other proof that the controls are in place, when a contract involves personal information of citizens or government staff, ICT that stores or processes OFFICIAL data, or information about the daily business of government. The PPN tells buyers not to ask for it in every contract. For defence suppliers, the MOD's Def Stan 05-138 asks for Cyber Essentials at every cyber risk profile level, and for Cyber Essentials Plus at levels L2 and L3.

Check your contract and your assessor for what applies to you. This page is not legal advice.

Compliance has no self-assessment questionnaire for Cyber Essentials and does not submit anything to IASME. You answer the self-assessment with IASME and keep the evidence in Compliance.

Compliance does not track the 14 days that IASME allows for high risk and critical updates. It has no renewal schedule for Cyber Essentials. Compliance has one scope per account, so there is no separate Cyber Essentials scope.

You keep the records behind your answers in the general registers. The Asset register holds hardware, software and other kinds of assets. The Vulnerability register records each vulnerability with its severity, an optional CVSS score and a reference such as a CVE. Each vulnerability goes through two steps: Remediation, then Verification. Policies, risks and evidence go in their own registers.

Findings, events and supplier reviews work as they do for ISO frameworks. A Major or Minor finding gets a chain of tasks: Root cause investigation, Corrective action and Effectiveness check.

Compliance links related requirements across the frameworks you adopt. The crosswalk marks each link as Equivalent, Partial or Related. Evidence, findings and register records can meet requirements in several frameworks.

The crosswalk links Cyber Essentials to ISO 27001 and SOC 2:

• Firewalls: marked Equivalent to ISO 27001 A.8.20, A.8.21 and A.8.22, and to SOC 2 CC6.6.
• Secure configuration: marked Equivalent to A.8.5 and A.8.9, Partial to A.8.19 and CC5.2, and Related to CC7.1.
• Security update management: marked Equivalent to A.8.8 and CC7.1.
• User access control: marked Equivalent to A.5.15 and CC6.1, Partial to A.8.3 and A.8.4, and Related to A.5.16, A.5.17 and CC6.2.
• Malware protection: marked Equivalent to A.8.7 and CC6.8.
• The Cyber Essentials Plus tests: marked Partial to A.8.8 and CC7.1.

Evidence and findings you keep for the Equivalent links can meet requirements in several frameworks. The crosswalk also marks user access control as Related to Art. 32 of EU GDPR and UK GDPR. It links Cyber Essentials to BIO2 as well.

The crosswalk has no links from Cyber Essentials to ISO 9001, ISO 14001, ISO 42001, the EU AI Act or Dutch Arbo.

Proposed coverage suggests a link only when a record already covers a linked requirement in another framework you have adopted. You accept or dismiss each suggestion, and Compliance applies none of them on its own.

Your Cyber Essentials assessment and your ISO 27001 audit stay separate, even where the crosswalk marks requirements as Equivalent. A supplier review covers one supplier.

Compliance has registers for policies, procedures, risks, assets, vulnerabilities, suppliers, evidence and findings, among others. The registers are shared between the frameworks you adopt, so Cyber Essentials and ISO 27001 use the same records.

Compliance scores each risk on a 5×5 likelihood and impact matrix. Treatment actions lower the residual risk score.

Compliance creates recurring review tasks for policies, risks, assets and requirements. Every task has an owner and a due date, and all tasks appear in one inbox.

Compliance also has an AI assistant on every page. The assistant can run a Gap analysis session for Cyber Essentials. It reads your existing records, starts from the work on your other adopted frameworks, and asks you one question at a time about what it can't read. You confirm each suggestion. The assistant runs on AI credits, billed in USD, and it is not part of the trial unless you buy AI credits.

Michiel van der Meer built Compliance after taking over an ISMS at Jewel and seeing how much hand-work it took. He needed a better solution, so he built one.

Cyber Essentials is €199 per framework per year, excl. VAT. It includes $5 of AI credit per year, billed in USD, and you can buy extra credits. Users in your organisation are unlimited.

You pay for each framework you adopt separately.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

See all Compliance pricing →