Digital download
Cyber Essentials Preparation Kit
Nine editable Word documents and two Excel workbooks that help a small UK organisation prepare for Cyber Essentials and answer the self-assessment honestly. They cover the NCSC's Requirements for IT Infrastructure v3.3 and IASME's Danzell question set, in use since April 2026.
Independent and not certification. Tagnator is not part of, approved by or endorsed by the NCSC or IASME. The kit does not guarantee a pass: only an IASME certification body can assess you.
One payment, no subscription. As soon as you have paid, Polar emails you a link to the download, a ZIP file of about 390 KB. Polar is our merchant of record: it takes the payment and adds VAT where it applies.
1. Who it is for
- UK organisations of 1 to 50 people preparing for Cyber Essentials for the first time or renewing, where one person looks after IT.
- Suppliers asked for Cyber Essentials by a customer or in a public-sector tender.
If you want someone to do the work for you, a certification body or an NCSC assured Cyber Advisor is the better choice.
2. What is in the kit
Every file is editable. Documents 01 to 07 are three A4 pages each. Text you need to replace is highlighted in yellow and in [square brackets].
| File | What it gives you |
|---|---|
| Scope and Asset Register (Excel) | Eleven sheets: Scope Decisions (15 questions on personal devices, home workers, cloud services, IT providers and more), Scope Statement, User Devices, Servers, Mobile Devices, Network Equipment, Cloud Services, Software, Admin Accounts, Firewall Rules and Approved Apps. |
| Readiness Workbook (Excel) | A Summary that counts what is ready; a Question Walkthrough covering every question number in the Danzell question set, with what a good answer needs and the evidence to keep; a 30-Day Plan; an Evidence Checklist; and a Before You Submit check. The five automatic-fail questions are marked in red. |
| 00 Read Me First | How the scheme works, where small organisations get scope wrong, and a 30-day plan. |
| 01 Cyber Security Policy | The short top-level policy your owner or director signs: scope, commitments under the five controls, and roles. |
| 02 Firewall and Router Procedure | Boundary and software firewalls, admin passwords, remote admin and inbound rules. |
| 03 Secure Configuration Procedure | Removing what you do not use, default passwords, external services, auto-run and device locking. |
| 04 Security Update Procedure | Supported software, automatic updates, the 14-day rule and manual updates. |
| 05 User Access Control Policy | Account approval, leavers, separate admin accounts, password rules and MFA on every cloud service. |
| 06 Malware Protection Procedure | Anti-malware or approved apps, device by device. |
| 07 Staff Acceptable Use, BYOD and Home Working Policy | Ten rules for staff, conditions for personal devices and home working, and a signature table. |
| 08 Approval Forms and Checklists | Seven forms: new account, admin access, leaver or role change, firewall rule, compromised account, new device set-up and a monthly check. |
The ZIP also holds a plain-text copy of the Read Me. The files are standard Word (.docx) and Excel (.xlsx) files.
3. How it follows the question set
The Question Walkthrough is organised by the Danzell question numbers, from A1 (your organisation) to A8 (malware protection), plus the declaration. Each policy and procedure starts with a document control table that lists the question numbers it helps you answer. Several questions ask you to describe a process, such as how accounts are approved or how leavers lose access; the forms in document 08 give you a record that the process is followed.
The kit describes each question in its own words and does not reproduce IASME's question set. Download the free official booklet from IASME and use the two side by side.
Since April 2026, five answers fail the whole assessment on their own: 14-day updates for operating systems and firmware (A6.4) and for applications (A6.5), and MFA on cloud services (A7.15 to A7.17). The kit puts these first.
4. Using it in thirty days
- Week 1: answer the Scope Decisions and list your devices, network equipment, cloud services and software.
- Week 2: fix the automatic-fail items: MFA on every cloud service, automatic updates, firmware, unsupported software.
- Week 3: admin accounts, leavers, device settings and malware protection; adapt and approve the documents.
- Week 4: work through the Question Walkthrough, collect the evidence, do the Before You Submit check, then apply.
5. What it is not
- Not certification, and not a guarantee of a pass. The controls must actually be in place on the day your certificate is issued, and an assessor decides.
- Not official. It is not produced or endorsed by the NCSC or IASME, and it contains no Cyber Essentials logo. You may use the Cyber Essentials certification mark only once you are certified, under IASME's rules.
- Not paperwork for its own sake. Cyber Essentials checks technical controls, not documents. The documents help you run the controls and describe your processes.
- Not Cyber Essentials Plus preparation. Plus adds a technical audit of sample devices, which the kit does not cover.
- Not a set of product guides. It says what must be true, not which settings to change in a particular product.
6. Licence, updates and refunds
One licence covers one organisation. You can edit and rebrand the documents, use them inside your organisation, and share them with your certification body, auditors, customers and suppliers. You cannot resell or publish the kit, or use it to supply templates to other organisations. To use it for several organisations, for example as an IT provider, email us before you buy.
Updates to version 1.x are free for one year from purchase.
If the kit is faulty or not as described, email us within 30 days and we will fix it, replace it or refund you. Because the kit is a download supplied straight away, the 14-day cancellation right for consumers ends once the download begins. The refund section of our terms has the details.
7. After you buy
Polar emails you an order confirmation with a link to your download. You can download the kit again at any time from Polar's customer portal at polar.sh/tagnator/portal. Sign in there with the email address you paid with.
Start with 00 Read Me First, then open the Scope Decisions sheet in the Scope and Asset Register.
For help, email support@tagnator.com with your order number. We reply within two working days. Polar handles your payment details; what we receive and keep is in the Cyber Essentials kit section of our privacy policy.
8. Questions
Which version of Cyber Essentials does it cover?
The NCSC's Requirements for IT Infrastructure v3.3 (April 2026) and IASME's Danzell question set (booklet version 16, April 2026), which apply to assessment accounts created after 26 April 2026. The scheme is updated every year, so check that your assessment still uses Danzell before you rely on the kit.
Will it get us certified?
Not by itself, and nothing can promise a pass. It helps you check your scope, fix the automatic-fail items, keep evidence and draft honest answers.
Does it include the questions?
No. It lists every question number with the topic in its own words. The official booklet is free from IASME.
Can we rebrand it?
Yes. Replace [Organisation] and the role names, add your logo, and delete what does not apply.
Something else?
Email support@tagnator.com. We are happy to answer questions before you buy.