Understanding the Cyber Essentials 2025 Update

Cyber Essentials is a government-backed certification scheme that helps UK businesses protect themselves against the most common cyber threats. It sets out a series of technical and procedural controls designed to strengthen everyday security, from managing user access to applying software updates promptly.

In April 2025, the National Cyber Security Centre (NCSC) and IASME Consortium introduced an updated version of the scheme, known as the Willow release. This update refines several key definitions, provides clearer guidance on modern authentication methods, and ensures the standard continues to reflect today’s evolving working practices.

Why the update matters

Cyber threats continue to evolve, and the way businesses use technology is changing just as quickly. The Cyber Essentials scheme is reviewed regularly to ensure that its requirements stay relevant and effective against emerging risks. Each update helps organisations maintain good cyber hygiene and build resilience against the most common types of attack.

For small and medium-sized enterprises, remaining compliant is not only about meeting a technical standard. It also demonstrates to clients, suppliers, and regulators that your business takes data protection seriously. Achieving certification can strengthen your reputation, improve trust with customers, and open up opportunities to work with larger organisations and public sector bodies.

Overview of key changes in 2025

The 2025 Willow update came into effect in April and replaces the earlier Montpellier question set. The update refines how certain requirements are defined and applied, helping organisations better align their practices with modern security standards. The most significant changes are outlined below.

• Passwordless authentication – The updated scheme introduces official guidance and a definition for passwordless authentication methods, such as biometrics or security keys. These technologies can reduce reliance on traditional passwords and strengthen protection against phishing attacks, although they are not yet a mandatory requirement.
• Updated definitions for software and vulnerability fixes – The term “software” has been clarified to include any components or configurations that affect the security of a system. The definition of a vulnerability fix now extends beyond traditional patches to cover configuration and registry changes, scripts, and other updates that resolve known weaknesses.
• Applying critical fixes within 14 days – Businesses must still apply any fixes for high or critical vulnerabilities within 14 days of release. This timeframe now applies to all forms of remediation, not only software patches, ensuring that all critical updates are addressed promptly.
• Home and remote working – References to “home working” have been expanded to include remote working more broadly. This change reflects the growing number of employees who access company systems from shared or public networks, emphasising the importance of maintaining security beyond the office environment.

These refinements bring the scheme up to date with current business practices and encourage a more proactive approach to security management.

What each change means for your business

Understanding how these updates apply in practice helps you stay compliant and improve your cyber resilience. The following points summarise what each change means for your organisation.

1. Passwordless authentication

• You do not have to adopt passwordless login, but it is recognised as a secure and modern approach.
• If you already use biometrics, hardware security keys, or one-time codes, these methods align well with the new guidance.
• Consider exploring passwordless options where possible to reduce the risk of stolen credentials.

2. Broader definition of software and vulnerability fixes

• The scheme now covers fixes made through scripts, configuration changes, or registry updates.
• Review your internal patching policy to ensure that these types of changes are logged and tracked alongside standard software updates.
• Make sure your IT team or provider can demonstrate evidence of applying all relevant fixes.

3. Fourteen-day window for critical fixes

• High or critical vulnerabilities, or those with a CVSS score of 7 or above, must be resolved within 14 days.
• This requirement now applies to any kind of fix, not just traditional patches.
• Keep a consistent schedule for updates and verify that remediation activity is documented.

4. Expanded scope for home and remote working

• Security controls must protect devices used outside the office, whether at home, in shared spaces, or on public networks.
• Apply the same standards for firewalls, antivirus protection, and update management on all devices that connect to company data.
• Ensure remote users can access systems securely through trusted VPNs or approved cloud services.

By reviewing each of these areas, SMEs can prepare for certification with confidence and maintain a strong foundation for cyber security.

Updates to Cyber Essentials Plus

The Cyber Essentials Plus (CE+) assessment has also been refined under the Willow update. The changes mainly clarify how assessments are carried out rather than introducing new controls. Certification bodies must now ensure that the CE+ scope exactly matches the scope of the related Cyber Essentials self-assessment, and assessors are required to verify and record device sampling details. These adjustments aim to make the audit process more consistent and transparent for all organisations.

Require assistance with Cyber Essentials certification?

The help4IT team supports small and medium-sized businesses in achieving and maintaining Cyber Essentials certification. Our specialists can guide you through the latest 2025 requirements, assess your current controls, and help you strengthen your organisation’s cyber resilience.

Get in touch today for a free consultation to find out how we can help your business stay secure and fully compliant with the Cyber Essentials scheme.