Cyber Essentials guide

The Cyber Essentials question set, section by section

Cyber Essentials is a self-assessment. You answer a questionnaire about your IT, a board member or the owner signs a declaration that the answers are true, and an assessor at an IASME certification body marks them. The questions are published in advance, so there is no reason to meet one for the first time in the portal. This guide walks through the current question set, says what evidence each section rests on, and lists the answers that fail the whole assessment on their own.

The current set is called Danzell (version 16, April 2026). IASME, the NCSC's delivery partner, uses it for every assessment bought from 27 April 2026; assessments bought before that date stay on the previous set, Willow. Danzell goes with version 3.3 of the NCSC's Requirements for IT Infrastructure, also dated April 2026. Question numbers below are Danzell's.

Last checked 9 November 2026 against IASME's published Danzell question set (version 16), the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 and IASME's Cyber Essentials pages. This is general information. Tagnator is not part of, approved by or endorsed by the NCSC or IASME; only an IASME certification body can assess you.

1. How the assessment works

You buy the assessment from IASME or through a certification body, at a price set by your size: £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. A government discount of 75% applies to small and medium-sized organisations applying for their first certificate, bought by 31 March 2027 (see our small business guide). You then get access to the online portal, where you enter answers you can prepare in the free downloadable question set.

Every question must be answered. Most are yes or no with a box for notes; several ask you to describe a process. Your answers must be approved by "a Board level representative, business owner or the equivalent", otherwise certification cannot be awarded. The assessor marks the answers and gives feedback; the controls must be in place at the time you answer, not planned.

Two documents matter alongside the questions. The NCSC's Requirements for IT Infrastructure is the standard the questions test; question A1.11 asks whether you have read it. Our plain guide summarises its five controls. The second is your own asset list: most answers are easier when you have a sheet of your devices, operating systems, cloud services and admin accounts.

2. A1: Your company

Sixteen questions about who you are: legal name and organisation type (A1.1, A1.2), registration numbers and your registered and operational addresses (A1.3 to A1.5), whether more than one legal entity is in scope (A1.6), your main business and whether this is a renewal or a first application (A1.7 to A1.9), your two main reasons for certifying (A1.10), whether you have read the Requirements document (A1.11), whether you used an NCSC assured Cyber Advisor (A1.12), and consents for IASME to contact you (A1.13 to A1.16).

Evidence: none beyond Companies House or charity details. Common fail: none here, but the name in A1.1 must be one legal entity, because it appears on the certificate; a trading name that does not match the certificate is a problem later when a customer checks it.

3. A2: Scope of assessment

The scope section decides what the rest of the questions are about. A2.1 asks whether the assessment covers your whole organisation or part of it; "whole organisation includes all networks, user accounts and devices which access your organisation's data and services". A partial scope must be separated by a firewall or VLAN and described in detail (A2.2), and the certificate then says "Partial Organisation". You then list your sites and networks (A2.3, A2.4), how many staff work from home or remotely and how they connect (A2.4.1, A2.4.2), the quantities and operating systems of your laptops, desktops and virtual machines (A2.6), thin clients, servers and hypervisors (A2.7), tablets and mobile phones with make and operating system (A2.8), every cloud service (A2.9) and the person in your organisation who manages the IT in scope (A2.10).

Evidence: an asset register with make, model and operating system version for every device, and a list of cloud services by type (SaaS, PaaS, IaaS). Common fails: leaving out personal phones and laptops that read company email or files (user-owned devices that access organisational data are in scope; only devices used solely for calls, texts or an authenticator app are out); listing "Windows" without the version, which the assessor cannot mark; trying to exclude cloud services, which the Requirements say "cannot be excluded from scope"; "a scope that does not include end user devices is not acceptable"; and naming your outsourced IT provider as the responsible person in A2.10, which the question does not allow.

4. A3: Insurance

Three questions decide whether you get the cyber insurance that comes with certification: whether your head office is in the UK or Crown Dependencies and your gross annual turnover is under £20m (A3.1), whether you want the included insurance (A3.2) and an email address for the documents (A3.3). The answers do not affect the result. The cover is a £25,000 limit of indemnity with a 24-hour incident helpline, for a whole-organisation self-assessed certification; see the insurance section of the small business guide.

5. A4: Firewalls

A4.1 asks whether you have firewalls between your internal networks, devices and the internet, and A4.1.1 whether the software firewall is enabled on every computer, laptop and server, "even when sitting behind a physical/virtual boundary firewall". A4.2 asks whether you have changed the default password on every router and firewall, "including those that come with a unique password pre-configured"; A4.3 and A4.4 ask how the firewall password is set and protected; A4.5 whether you have a process to manage the firewall; A4.6 whether you reviewed the rules in the last 12 months; A4.7 to A4.11 cover inbound connections from the internet: whether any are allowed, the documented business case for each (signed off at board level and reviewed), and whether remote access to the firewall's settings is protected by MFA or an IP allow list.

Evidence: a short firewall procedure, a rules review dated within the year, and a record for each open port or inbound rule. Common fails: an ISP router still on its sticker password; home workers whose laptops rely on the home router (the Requirements say other routers are out of scope, so the laptop's own firewall must do the job); and a port left open "because it has always been" with no written reason.

6. A5: Secure configuration

A5.1 asks whether you have removed or disabled software and services you do not use on every type of device and in your cloud services, and how. A5.2 and A5.3 ask the same about user accounts: only accounts that are regularly used in the business may remain. A5.4 and A5.5 ask how an external service of yours (a website login, a remote desktop) is protected, choosing from MFA with an 8-character minimum password, a block on common passwords with 8 characters, 12 characters, or passwordless; A5.6 and A5.7 ask how it resists brute force when MFA is not used, by throttling attempts or locking after 10 failures. A5.8 asks whether auto-run of downloaded files is disabled. A5.9 and A5.10 ask whether devices lock when unattended and what unlocks them (PIN, password, biometric).

Evidence: a configuration checklist you run on each new device, and the settings in your cloud admin consoles. Common fails: a shared "reception" login; guest accounts left enabled; a public web app with no lockout or throttling.

7. A6: Security update management

A6.1 asks whether every operating system on your devices, including the firmware of routers and firewalls in scope, is still supported by a vendor that produces regular security updates. A6.2 asks the same for all applications and cloud services, and A6.3 asks you to list anything unsupported or unlicensed. A6.4 asks whether all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware are installed within 14 days of release; A6.5 asks the same for applications, including extensions. A6.6 asks whether unsupported software has been removed, and A6.7 whether, if you must keep it, the devices have been moved out of scope into a separate sub-set that prevents all internet traffic.

The Requirements define the 14-day rule: it applies where the vendor describes the fix as "critical" or "high risk", where the vulnerability has a CVSS v3 base score of 7 or above, or where the vendor gives no severity at all. Feature updates and optional updates are not required for the question, although the NCSC recommends applying all updates within 14 days.

Evidence: automatic updates switched on and a monthly check that they ran; firmware versions recorded against the vendor's release notes; the end-of-life date for each operating system. Common fails: an old phone or tablet on an operating system no longer updated; a router whose firmware has never been checked; and answering "yes" to A6.4 when some devices are only patched when someone remembers. These two questions are automatic fails, so an honest "no" has to be fixed before you apply, not explained in the notes.

8. A7: User access control

The longest section. A7.1 asks whether accounts are created only after an approval process and asks you to describe it; A7.2 whether all user and admin accounts use unique credentials, with no sharing; A7.3 how you delete or disable accounts of staff who leave. A7.4 asks whether staff have only the access they need for their current job. A7.5 to A7.9 cover administrator accounts: a formal process for granting admin access, separate admin accounts used only for admin tasks, tracking who has them and reviewing the list regularly. A7.10 to A7.12 ask how passwords are protected from brute force and which technical controls manage their quality, and A7.13 what you do when a password or account may have been compromised.

A7.14 to A7.17 are about cloud services. A7.14 asks whether every cloud service you use offers MFA. If not, A7.15 asks you to list the services that offer no MFA option at all. A7.16 asks whether MFA is applied to all administrators of your cloud services, and A7.17 whether it is applied to all users, in each case "excluding any listed in A7.15 that do not provide it" and together with a password of at least 8 characters.

Evidence: the account approval form or ticket for your last few joiners and leavers, a list of admin accounts with the date it was last reviewed, and a screenshot of each cloud service's MFA enforcement setting. Common fails: day-to-day work done from an admin account; a leaver's mailbox still live; MFA "available" but not enforced for every user of Microsoft 365, Google Workspace or your accounting package; and listing a service in A7.15 that in fact offers MFA, which the question set says is an automatic fail.

9. A8: Malware protection

A8.1 asks how every desktop, laptop, tablet and phone is protected from malware: option A, anti-malware software installed; option B, limiting installation to an approved list of applications, for example an app store with a list of approved apps or a mobile device management tool; or option C, neither, with an explanation. The question notes that most organisations with smartphones and standard laptops need both A and B. If you chose A, A8.2 to A8.4 ask whether the software keeps itself up to date, scans files and web pages, and warns about known malicious websites. If you chose B, A8.5 asks whether users can install only approved applications and how the list is maintained.

Evidence: the anti-malware console or a screenshot per device type; the MDM policy or the written list of approved apps for phones. Common fails: phones with no answer at all (they are in scope if they read company email); "we use Macs" as if that were a control; and anti-malware that is installed but not set to update or scan automatically.

10. The five automatic fails

Since the Danzell question set, five answers fail the assessment outright, whatever else you answer:

Everything else is marked on the whole, with feedback and the chance to correct answers. These five are the ones to fix first, because no amount of good answers elsewhere offsets them.

11. What to do next

  1. Download the free question set from IASME and read the NCSC Requirements v3.3 once.
  2. Build the asset list that A2 needs: every device with its operating system version, every cloud service, every admin account.
  3. Fix the five automatic fails: automatic updates and a 14-day check, MFA enforced on every cloud service for every user.
  4. Write the four short processes the questions ask you to describe: account approval (A7.1), leavers (A7.3), admin access (A7.5) and the firewall (A4.5).
  5. Answer in the portal, get the owner or a director to read the answers before signing, and keep the evidence for the renewal in 12 months.

Our Cyber Essentials Preparation Kit gives you the asset register, a walkthrough of every Danzell question number with the evidence to keep, and the policies and approval forms behind the processes the questions ask you to describe. It does not reproduce the questions themselves, which are free from IASME.

Related guides: Cyber Essentials for small UK businesses · Cyber Essentials or Cyber Essentials Plus?

12. Sources