Cyber Essentials (UK)

Arrive at the Cyber Essentials portal with the answers already written.

Cyber Essentials is the certification most UK public-sector buyers and many larger private ones require of a supplier that touches their data. Its self-assessment is a set of facts about your IT: devices, sign-in, updates, malware protection, access. Rowpa holds those facts as a security profile you fill in once, and reads them back the way the scheme asks, area by area, ready to copy in.

Build your security profile free See it in the demo

Rowpa does not certify. Certification is through an IASME-licensed body; Rowpa gets you there with the answers in hand.

The honest position

Rowpa is not a certification body and this is not the assessment. What it does is smaller and useful: the thirty-odd items the scheme cares about (MFA on email and cloud services, automatic updates within 14 days, no unsupported software, admin accounts separate, device encryption and locking, malware protection, firewalls) are the same items every supplier security questionnaire asks, so you answer them once in your security profile. The Cyber Essentials page then shows your answer beside each area, marks the ones where you said something the scheme would not accept, says which items you have not answered, and lists the inventory Rowpa does not hold: your device list with operating systems, every cloud service you use, how many people work remotely.

Since the 2026 question set, cloud services are in scope and passwordless sign-in counts. The mapping is versioned so a reissue of the questions is a data change, not a rebuild.

What the page gives you

Area by area

Your organisation and scope, insurance, firewalls, secure configuration, security update management, user access control, malware protection, and backups (asked, not assessed), in Rowpa's own words for what each area wants.

Look at this first

Where your profile says no or partly and the scheme expects yes, the row is flagged before you submit. Change the fact in your profile, or fix the thing, but do not find out from the assessor.

What you still have to gather

Device inventory, operating system versions, cloud services, remote workers, company details. Rowpa says plainly what it does not hold, with what to collect.

Copy, or print

Each answer has a copy button, because the destination is the IASME portal. Or print the page and work from paper.

The same answers everywhere

The profile also feeds your supplier due diligence pack and the questionnaire drafts, so a buyer's spreadsheet and the assessment portal never disagree about your MFA.

Who this is for

UK firms with a handful of laptops and a few cloud services, being asked for Cyber Essentials by a customer or a tender. If you have an IT provider, the profile is the list of questions to ask them.

What it is not

It is not Cyber Essentials Plus, which needs a technical audit, and it does not replace reading the scheme's requirements. The link to the NCSC overview is on the page.

Pricing

Free. The security profile and the Cyber Essentials reading are part of your record on every plan.

Start free See all plans

Common questions

Does Rowpa certify me for Cyber Essentials?

No. Certification is issued by an IASME-licensed certification body after you submit the self-assessment. Rowpa prepares your answers and tells you what to look at first.

Is this only for UK companies?

Yes. Cyber Essentials is a UK scheme, so the page is shown to UK workspaces. The security profile itself is used everywhere.

Do you reproduce the IASME question set?

No. The areas and prompts are Rowpa's own wording for what each part of the assessment asks about. The question set belongs to IASME.

What if my profile says no to something the scheme requires?

The row is flagged as one to look at. Rowpa does not change your answer; you either fix the control or decide with your assessor. A flagged row is a saved conversation, not a failure.