Cyber Essentials for UK VPS Hosting: Complete Compliance Guide 2026

Introduction

If your UK business handles customer data, processes online payments, or provides digital services, you've probably heard of Cyber Essentials. But what does it actually mean for your VPS hosting?

Cyber Essentials is a UK government-backed certification scheme that helps organisations protect themselves against common cyber threats. For businesses using VPS hosting—whether you're running a WordPress site, a SaaS application, or an e-commerce store—achieving Cyber Essentials isn't just about compliance. It's about building trust with customers, winning government contracts, and reducing your attack surface.

In this guide, we'll explain exactly what Cyber Essentials requires from your hosting infrastructure, how to choose a Cyber Essentials-compatible VPS provider, and step-by-step instructions for securing your UK VPS to meet the certification criteria.

What Is Cyber Essentials?

Cyber Essentials is a certification scheme developed by the UK Government's National Cyber Security Centre (NCSC). It was launched in 2014 to help organisations protect themselves against the most common cyber attacks—things like phishing, malware, ransomware, and password theft.

There are two levels:

• Cyber Essentials — Self-assessment, verified by an external certification body. Costs around £300–£500 + VAT.
• Cyber Essentials Plus — Same controls, but verified by an independent assessor who tests your systems in person. Costs around £1,500–£2,500 + VAT.

Both certifications require you to implement five core technical controls:

1. Firewalls — Secure your internet connection with properly configured firewalls
2. Secure Configuration — Remove unnecessary software and change default passwords
3. User Access Control — Limit who can access your systems and data
4. Malware Protection — Install and maintain antivirus/anti-malware software
5. Patch Management — Keep all software and devices up to date

Why Cyber Essentials Matters for UK VPS Users

1. Government Contracts

If you want to bid for UK government contracts worth over £5,000 per year that involve handling personal data, Cyber Essentials is mandatory. The Crown Commercial Service requires it for all suppliers handling sensitive information.

2. Client Trust

Displaying the Cyber Essentials badge on your website signals to clients that you take security seriously. For agencies and SaaS providers, this can be a competitive differentiator.

3. Insurance Requirements

Many cyber insurance policies now require Cyber Essentials certification as a minimum. Without it, you may face higher premiums or be denied coverage altogether.

4. GDPR Compliance

While Cyber Essentials doesn't guarantee GDPR compliance, it covers many of the same technical controls that the ICO expects to see—particularly around access control, patching, and malware protection.

5. Reduced Attack Surface

The five controls are designed to block 80% of common cyber attacks. For a VPS exposed to the public internet, this is your first line of defence.

The 5 Cyber Essentials Controls Applied to VPS Hosting

1. Firewalls

What Cyber Essentials requires: A properly configured firewall must protect your internet connection. Only necessary ports and services should be exposed. Default firewall rules should block all inbound traffic except what's explicitly allowed.

How to implement on your UK VPS:

# Install UFW (Uncomplicated Firewall)
sudo apt update && sudo apt install ufw -y

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (change to your custom port if you changed it)
sudo ufw allow 22/tcp

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Check status
sudo ufw status verbose

Hostingowy tip: Every Hostingowy VPS comes with a cloud firewall that you can configure from the dashboard before your server even boots. This means your VPS is never exposed to the internet without protection.

2. Secure Configuration

What Cyber Essentials requires: Default passwords must be changed. Unnecessary software must be removed. Unnecessary accounts must be disabled. Services should run with minimal privileges.

How to implement on your UK VPS:

# Change root password immediately
passwd

# Create a non-root user with sudo
sudo adduser deploy
sudo usermod -aG sudo deploy

# Disable root SSH login
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Remove unnecessary packages
sudo apt autoremove --purge -y

# List all listening services and audit them
sudo ss -tlnp

3. User Access Control

What Cyber Essentials requires: Users should only have the access they need to do their job. Admin accounts must be strictly controlled. Inactive accounts must be removed.

How to implement on your UK VPS:

# Create application-specific users
sudo useradd -m -s /bin/bash webapp
sudo useradd -m -s /bin/bash dbadmin

# Install and configure Fail2ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Set up SSH key authentication only
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

4. Malware Protection

What Cyber Essentials requires: Malware protection must be installed on all devices. It must be kept up to date and provide real-time protection.

How to implement on your UK VPS:

# Install ClamAV (open-source antivirus)
sudo apt install clamav clamav-daemon -y
sudo systemctl stop clamav-freshclam
sudo freshclam  # Update virus definitions
sudo systemctl start clamav-freshclam

# Scan critical directories
sudo clamscan -r /etc
sudo clamscan -r /var/www

# Set up daily scans via cron
sudo crontab -e
# Add: 0 2 * * * /usr/bin/clamscan -r /home --quiet -l /var/log/clamav/daily-scan.log

5. Patch Management

What Cyber Essentials requires: All software must be kept up to date with security patches applied within 14 days of release. A patch management policy must be documented.

How to implement on your UK VPS:

# Configure automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Manual patching
sudo apt update && sudo apt upgrade -y

# Check for pending reboots
cat /var/run/reboot-required

Choosing a Cyber Essentials-Compatible VPS Provider

Requirement	Why It Matters	Hostingowy
UK data centres	Your data must remain under UK jurisdiction	✅ London datacentre
Cloud firewall	First line of defence before OS boots	✅ Included on all plans
ZFS snapshots	Quick rollback after patching	✅ Every VPS includes snapshots
UK support	Within ICO jurisdiction	✅ UK-based engineering team
ISO 27001 compliance	Provider's own security posture	✅ Certified
DPA 2018 compliant	Required by Cyber Essentials framework	✅ Full compliance

Step-by-Step: VPS Preparation for Cyber Essentials Assessment

Week 1: Foundation

• Deploy a fresh VPS with Ubuntu 24.04 LTS
• Configure cloud firewall (allow only SSH, HTTP, HTTPS)
• Change root password, create non-root admin user
• Install and configure UFW
• Disable root SSH login, enable key-only auth
• Install and configure Fail2ban

Week 2: Hardening

• Remove unnecessary packages and services
• Install ClamAV and configure daily scans
• Configure unattended-upgrades for security patches
• Set up log monitoring
• Review and disable any unnecessary user accounts
• Document your secure configuration baseline

Week 3: Documentation & Assessment

• Document all firewall rules and justify each open port
• Create a patch management policy
• Create an access control policy
• Test your backup and restore procedures
• Run a self-assessment against the Cyber Essentials checklist
• Submit your self-assessment to a certification body

Common Cyber Essentials Mistakes to Avoid

❌ Leaving Default SSH Port

The assessor will check whether you've changed from port 22. Leaving default ports shows a lack of attention to secure configuration.

❌ Not Documenting Your Configuration

Cyber Essentials requires documented policies. If you can't show a patch management policy, you'll fail—even if your server is fully patched.

❌ Using Unsupported Software

If your VPS runs Ubuntu 20.04 (standard support ended April 2025) or any end-of-life software, you'll fail the patch management control. Always use LTS releases still in support.

❌ Forgetting Third-Party Services

Database servers (MySQL, PostgreSQL, MongoDB), caching layers (Redis, Memcached), and other services must also be patched and secured. Unsecured Redis instances are a common finding in Cyber Essentials audits.

How Hostingowy Helps with Cyber Essentials

We built Hostingowy with UK compliance requirements in mind:

• UK Data Centre — All VPS instances run from our London datacentre, keeping your data under UK jurisdiction
• Cloud Firewall — Configure network-level firewall rules before your server boots
• ZFS Snapshots — Take instant snapshots before applying patches, with zero-downtime rollback
• NVMe Storage — Fast I/O for your security tools and log analysis
• UK Support — Real engineers based in the UK, available during business hours
• Free Migration — We'll help you migrate from your current provider with zero downtime

Summary

Cyber Essentials is achievable for any UK business running a VPS—you just need to be systematic about implementing the five controls. The certification opens doors to government contracts, builds client trust, and genuinely improves your security posture.

Start with the week-by-week checklist above, and you'll be ready for assessment within a month. If you need any help securing your VPS, our engineering team is always available.