[Home](/)/[Resources](/resources)/UK Cyber Essentials for Connected Product Companies UKCybersecurityCertification guide # UK Cyber Essentials for Connected Product Companies Cyber Essentials certifies your company's IT security practices, not your product's security features — a distinction that trips up hardware companies who assume PSTI compliance for their connectable product also covers this. If you sell to UK government bodies or security-conscious enterprise buyers, you may need both. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuk-cyber-essentials-connected-products) At a glance Administered by NCSC-backed scheme, IASME as delivery partner Certifies Organisational IT security practices Two tiers Cyber Essentials, Cyber Essentials Plus Common requirement for UK government contracts, enterprise procurement Distinct from PSTI Act product security requirements ## What Cyber Essentials actually certifies ### It’s about your company, not your product Cyber Essentials assesses an organisation’s own IT security controls — firewalls, secure configuration, access control, malware protection, and patch management across the company’s systems and devices — not the security features engineered into a hardware product you sell. ### Two certification tiers Cyber Essentials is a self-assessment verified by an external assessor; Cyber Essentials Plus adds an independent technical audit and testing of the same control areas, giving buyers a higher level of assurance. ### Government contract requirement Many UK government contracts and grants that involve handling certain data types require the supplier to hold current Cyber Essentials (or Plus) certification as a prerequisite — a practical, non-optional business requirement for hardware companies pursuing public-sector sales. ## How this differs from PSTI product security rules ### PSTI governs the product; Cyber Essentials governs the company The Product Security and Telecommunications Infrastructure (PSTI) Act sets minimum security requirements for connectable consumer products themselves (default password bans, vulnerability disclosure policies, minimum security update periods). Cyber Essentials assesses the security of the company’s own IT estate — the two obligations run on entirely separate tracks. ### A company can hold one without the other A hardware company can be fully PSTI-compliant on its products while lacking Cyber Essentials certification for its own IT systems, and vice versa — buyers who require both should be told to expect two distinct compliance artefacts, not one. ### Both matter for security-conscious buyers Enterprise and government buyers increasingly ask for evidence of both: PSTI-aligned product security documentation to show the device itself is safe to deploy, and Cyber Essentials certification to show the vendor’s own systems won't become a weak link in the buyer's supply chain. ## Deciding whether to pursue certification 01 Check whether your target UK government contracts or enterprise RFPs list Cyber Essentials (or Plus) as a requirement — this is the most common trigger for pursuing certification. 02 Assess your current IT security posture against the five core Cyber Essentials control areas before engaging a certifying body, so gaps are identified and closed ahead of formal assessment. 03 Decide between standard Cyber Essentials (self-assessment, externally verified) and Cyber Essentials Plus (independent technical testing) based on what your target buyers specifically require. 04 Keep certification current — it is typically renewed annually, and a lapsed certificate can disqualify you from contracts that list it as a live requirement rather than a one-time credential. 05 Do not conflate this with your PSTI product security obligations — maintain both compliance tracks separately and be ready to evidence each on its own terms. ## Frequently asked questions ### Does Cyber Essentials certify my hardware product’s security? No. Cyber Essentials certifies your organisation’s own IT security controls, not the security features built into a hardware product. Product-level security for connectable consumer devices is addressed separately under the PSTI Act. ### Do I need Cyber Essentials to sell hardware in the UK? Not as a general legal requirement — it is not mandatory for market access the way PSTI product security rules are. It becomes practically necessary when a specific government contract, grant, or enterprise buyer requires it as a procurement condition. ### What is the difference between Cyber Essentials and Cyber Essentials Plus? Standard Cyber Essentials is based on a self-assessment questionnaire, independently verified by an external assessor. Cyber Essentials Plus adds a hands-on technical audit, including vulnerability scanning and testing, giving a materially higher level of independent assurance. ### How often does Cyber Essentials certification need to be renewed? It is generally renewed on an annual basis. Buyers requiring the certification as a contract condition typically expect a currently valid certificate, not one that has lapsed since a prior renewal cycle. **Disclaimer:** This page is an educational resource only and does not constitute legal or regulatory advice. Cyber Essentials scheme requirements and procurement policies referencing it can change — consult current NCSC/IASME guidance before making certification decisions. 🇬🇧 UK roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇬🇧 UK compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $199](/courses/37-uk-cyber-security-resilience-bill-connected-devices)[Prefer to read? Get the book — $24.99](/books/37-uk-cyber-security-resilience-bill-connected-devices) Related guides * [UK PSTI SecurityComplete guide to UK PSTI Act: security requirements for connectable products, compliance obligations, statement of compliance,…](/guides/uk-psti-security) * [UK PSTI Cyber RequirementsComplete guide to UK PSTI Act 2022 cybersecurity requirements: which connected products are in scope, the three mandatory minim…](/guides/uk-psti-cyber-requirements) * [FCC Cyber Trust MarkEligible categories, the NIST baseline, and the accredited-lab testing process for the US IoT cybersecurity label.](/guides/fcc-cyber-trust-mark) * [EU CRA Vulnerability ReportingThe Cyber Resilience Act's 24-hour and 72-hour vulnerability and incident reporting deadlines, explained.](/guides/eu-cra-vulnerability-reporting-obligations)