Cyber Essentials is about to become the price of admission for supplying larger UK organisations. dataplanet takes your business from wherever you're starting through gap analysis, certification, and year-round compliance management. One monthly fee, scaled to your organisation, with no surprise renewal scramble.
In April 2026 the UK Government launched the Cyber Resilience Pledge, backed by £90 million of investment, asking the FTSE 350 and other major employers to put cyber security on the board agenda and to audit Cyber Essentials coverage across their own supply chains, registering with a new Cyber Essentials Supplier Check Tool within two months of signing.
This sits alongside requirements already in force elsewhere in the supply chain:
Has required CE Plus specifically, not just CE, from in-scope suppliers since September 2025.
Suppliers must hold Cyber Essentials to work on most MOD contracts.
Six of the UK's largest banks, including Barclays, Lloyds and Nationwide, signed their own Cyber Essentials Supply Chain Commitment in October 2024.
The direction of travel: as large buyers formalise these commitments over the next 12–18 months, Cyber Essentials is moving from a competitive differentiator to a minimum entry ticket. The requirement is expected to filter down from the FTSE 350 through their supply chains to most sizeable businesses, not stay confined to the largest employers.
Cyber Essentials changed materially on 27 April 2026 with the move to the new Danzell (v3.3) question set. Two changes matter most for anyone already certified or planning to certify.
MFA is now an automatic fail if a cloud service offers multi-factor authentication and it isn't switched on, no partial credit, no remediation window.
14-day patch window. Critical and high-risk security updates must be applied within 14 days, with expanded sampling at Cyber Essentials Plus if a device is found out of date.
The declaration a director or board member signs now includes an explicit commitment to maintain the five Cyber Essentials controls throughout the full 12-month certification period, not just on assessment day.
Drift between renewals that would once have been quietly fixed before the next audit can now cause an outright fail.
Two tiers, so you only pay for the level of assurance your business and your customers actually need.
Cyber Essentials certification, managed end to end, with continuous monitoring in between renewals.
Cyber Essentials and Cyber Essentials Plus, independently audited, for businesses that need to prove it, not just claim it.
Always-on compliance checks across desktop and mobile, including BYOD, so drift gets caught before an audit does.
Keeps common third-party software up to date on Windows and Mac, closing off a leading cause of breaches.
Built-in training for your team; the Plus tier adds role-based paths, phishing simulations and reporting.
Self-serve policy builder, consent management and subject-access request workflows (Plus tier).
Guided self-assessment certification, with unlimited free submissions and expert guidance.
The same five controls, verified on-site by an independent technical assessor.
One monthly price, scaled to you. Both tiers are priced per licence band across your organisation's device and user count, so an 8-person office and an 800-seat business both pay a fair, proportionate rate. No separate invoice for the gap analysis, no surprise bill at renewal.
Readiness review against the current Danzell question set.
Close any control gaps found before you submit.
CE or CE Plus assessment/audit, guided end to end.
Monthly monitoring and evidence, kept current.
Re-certification scheduled before expiry, on repeat.
A pass on assessment day used to be the finish line. Under Danzell it's the starting point: the director declaration now runs for the full 12 months, and drift that would once have been quietly fixed before the next audit can cause an outright fail.
Dataplanet keeps the five controls in place between renewals, not just on the day of the audit, so the declaration your director signs stays true, and the next renewal is a formality rather than a scramble.
Your device compliance is checked every month, not once a year.
Admin and documentation kept current for the next audit.
Scaled to headcount, no surprise renewal bill.
Re-certification scheduled before expiry, on repeat.
One honest note. Cyber Essentials is a floor, not a ceiling — a certificate confirms the fundamentals are in place, and the fundamentals stop the majority of common attacks. But certification isn't the same as security. Our approach is to build the security properly and let the certificate evidence it, not to chase a badge that papers over gaps. If a gap analysis shows you need more than the baseline, we'll tell you that too. It's the reason this page sits next to one called Proof, Not Promises.
Supply chain requirements for Cyber Essentials are accelerating — we've written about why. Whether you need the certificate by a deadline or just want to know where you stand, the first conversation is free and honest.