Ask for a walkthrough
Menu

Guide · Cyber Essentials

Cyber Essentials and PCI DSS: do you need both?

Cyber Essentials and PCI DSS are separate requirements, asked for by different parties, so holding one does not satisfy the other. You need Cyber Essentials when a customer, contract or funding rule asks for it, and PCI DSS applies when you store, process or transmit payment card data or can affect its security.

Applies to Cyber Essentials, Requirements for IT Infrastructure v3.3 (April 2026); PCI DSS v4.0.1Last checked 13 Oct 2026Published 14 Oct 2026Written by Moshiul Islam Mishu, who has led PCI DSS assessments since 2018

In shortCyber Essentials
  • Cyber Essentials is a UK government-backed scheme with five technical controls across your organisation's IT.
  • PCI DSS is the card industry's standard, with twelve requirements for the environment that handles card data.
  • Six of the twelve PCI DSS requirements deal with subjects similar to the five Cyber Essentials controls. The other six have no Cyber Essentials counterpart.
  • Where the subjects are similar, the scope and the detailed rules still differ, so each has to be evidenced on its own terms.
  • A Cyber Essentials certificate comes from a certification body licensed by IASME. PCI DSS is validated by a Qualified Security Assessor or by self-assessment. One does not stand in for the other.
On this pageWhat is the difference between Cyber Essentials and PCI DSS?Where do the controls overlap?Who needs which?Does one count towards the other?What an assessor will ask to seeHow the platform helpsSources

What is the difference between Cyber Essentials and PCI DSS?

Subject Cyber Essentials PCI DSS v4.0.1
Who sets it The NCSC, delivered through IASME [3] The PCI Security Standards Council [4]
What it is for A baseline of five technical controls for your IT [1] Protecting payment account data [4]
What is in scope Your whole organisation’s IT, or a defined and separately managed sub-set. End-user devices and cloud services cannot be left out [1] Systems that store, process or transmit cardholder data, and anything that could affect the security of that environment [4]
Size Five controls Twelve requirements
Who asks for it Customers, government buyers and some funders Card brands and acquirers [5]
How it is checked Your answers to a question set, marked by an assessor. Cyber Essentials Plus adds independent technical testing [3] A Self-Assessment Questionnaire or a Report on Compliance, as your acquirer or the card brand decides [5]
How long it lasts 12 months [2] Set by your acquirer or the card brand [6]

Where do the controls overlap?

Going by the titles of the twelve PCI DSS requirements, six deal with subjects similar to the five Cyber Essentials controls. The PCI DSS names below are shortened.

Cyber Essentials control PCI DSS requirement on a similar subject
Firewalls Requirement 1: Network security controls
Secure Configuration Requirement 2: Secure configurations
Security Update Management Requirement 6: Secure systems and software
User Access Control Requirement 7: Access by need to know. Requirement 8: Identification and authentication
Malware Protection Requirement 5: Malicious software

PCI DSS then goes further, into subjects outside the five Cyber Essentials controls:

  1. Requirement 3: Stored account data.
  2. Requirement 4: Cardholder data sent over open, public networks.
  3. Requirement 9: Physical access.
  4. Requirement 10: Logging and monitoring.
  5. Requirement 11: Security testing.
  6. Requirement 12: Policies and programmes.

This comparison is ours and goes by title only. The Council says it holds no mapping between PCI DSS and other standards [9]. The twelve titles were read in the Council’s questionnaire for version 4.0 [8], and the Council says version 4.0.1 added and removed no requirements [10]. PCI DSS v4.0.1 itself is in the Council’s document library.

Each document sets its own detailed rules, for example on how quickly updates and patches must be applied and where multi-factor authentication (MFA) is needed. Read each in its own text and do not assume that meeting one meets the other.

Who needs which?

PCI DSS. The PCI Security Standards Council says the standard is for entities that store, process or transmit cardholder data, and for those that could affect the security of the cardholder data environment. It names merchants, processors, acquirers, issuers and service providers [4]. Whether you must validate, and how, is decided by the organisations that run compliance programmes, typically the payment brands and acquirers [5]. So the first question about PCI DSS goes to your acquirer.

Cyber Essentials. No law requires it in general. It is asked for on some central government contracts [2], across Ministry of Defence supply chains, of legal aid providers and further education colleges in England, and by a growing number of large companies.

Both. A payment firm that sells to a public body, or to a large customer that asks its suppliers for Cyber Essentials, will meet both.

Does one count towards the other?

No. Neither result stands in for the other.

  • A Cyber Essentials certificate is not a PCI DSS validation. The Council recognises its own form documents for that: the Report on Compliance, the Attestation of Compliance, the Self-Assessment Questionnaire and the scan attestation. It says a certificate or other document issued to show PCI DSS compliance, and not on those forms, is not acceptable as evidence [7]. Which of them you submit is for your acquirer or the card brand to decide [5].
  • A PCI DSS report is not a Cyber Essentials certificate. For government contracts, PPN 014 says a supplier without the certificate must show the buyer, by other means, that it meets the Cyber Essentials requirements. That is normally verified by an independent third party with the technical competence to do it [2]. PPN 014 does not mention PCI DSS.

The two do ask about similar things: firewall rules, device settings, updates and patching, user accounts and malware protection. Each asks inside its own scope and against its own rules, so each is evidenced separately.

The scopes can differ. Cyber Essentials starts from the whole organisation’s IT [1]. The Council’s questionnaire for version 4.0 asks whether you use segmentation to make the scope of a PCI DSS assessment smaller [8]. In practice a PCI DSS scope is usually narrower than the whole organisation.

What an assessor will ask to see

There are two different assessors.

  1. For Cyber Essentials: a scope that includes your end-user devices and every cloud service that holds your organisation’s data or services (Requirements v3.3, section D) [1].
  2. For Cyber Essentials: your answers across all five controls, for that whole scope.
  3. For PCI DSS: a documented scope for the assessment. The Council’s FAQ 1473 says assessors are responsible for checking that the scope, and which requirements apply, are correctly defined and documented [5].
  4. For PCI DSS: for any requirement marked not applicable, testing that shows it does not apply (FAQ 1473) [5].
  5. For each: evidence taken from the systems inside that assessment’s own scope.

How the platform helps

The platform shows where you stand on Cyber Essentials and on PCI DSS v4.0.1, and what to fix under each.

Sources

  1. “Cyber Essentials: Requirements for IT Infrastructure v3.3”, NCSC, April 2026, https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf, read 13 October 2026
  2. “Procurement Policy Note 014: Cyber Essentials scheme”, Cabinet Office, updated February 2025, https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html, read 13 October 2026
  3. “Cyber Essentials”, overview page, NCSC, undated, https://www.ncsc.gov.uk/cyberessentials/overview, read 13 October 2026
  4. “PCI Data Security Standard (PCI DSS)”, PCI Security Standards Council, undated, https://www.pcisecuritystandards.org/standards/pci-dss/, read 13 October 2026
  5. FAQ 1473, “What is the role of compliance-accepting entities and assessors in determining the applicability of PCI DSS requirements for merchant and service provider PCI DSS assessments?”, PCI Security Standards Council, March 2023, https://www.pcisecuritystandards.org/faqs/1473/, read 13 October 2026
  6. FAQ 1565, “Does an entity’s PCI DSS assessment result expire when the standard against which the entity was assessed is retired?”, PCI Security Standards Council, March 2023, https://www.pcisecuritystandards.org/faqs/1565/, read 13 October 2026
  7. FAQ 1220, “Are compliance certificates recognized for PCI DSS validation?”, PCI Security Standards Council, August 2023, https://www.pcisecuritystandards.org/faqs/1220/, read 13 October 2026
  8. Self-Assessment Questionnaire D for Merchants and Attestation of Compliance, for use with PCI DSS version 4.0, PCI Security Standards Council, April 2022, https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf, read 13 October 2026
  9. FAQ 1131, “Does the council have a mapping between PCI DSS and ISO 27002 (formerly ISO 17799) or other standards?”, PCI Security Standards Council, July 2012, https://www.pcisecuritystandards.org/faqs/1131/, read 13 October 2026
  10. “Just Published: PCI DSS v4.0.1”, PCI Security Standards Council, 11 June 2024, https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1, read 13 October 2026

This guide explains the scheme in general terms. It is not advice on your own application.

Normatiq is not a certification body. Cyber Essentials certificates are issued only by certification bodies licensed by IASME, the NCSC's delivery partner.

See it on your own case.

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.