Cyber Essentials and Cyber Essentials Plus have become baseline requirements for many organisations. Required for public sector contracts. Expected by insurers. Requested by customers.

But certification alone does not equal security.

In this session, we'll explore what Cyber Essentials and CE+ actually mean in practice in 2026. Where organisations commonly misunderstand the controls. Where audits expose gaps. And how the scheme interacts with modern risks such as supply chain dependency, remote working, cloud platforms, and third-party access.

We'll also look at the commercial realities. How insurers assess Cyber Essentials. What CE+ testing typically uncovers. And how to move from a compliance exercise to a genuinely strengthened security posture.

Designed for business leaders, IT teams, and risk owners, this session focuses on practical interpretation rather than theory. What the controls require. What they don't. And how to approach certification in a way that supports resilience rather than simply achieving a pass.