Cyber Essentials can answer the questionnaire questions that match its five technical controls: firewalls, secure configuration, update management, user access control and malware protection. Attach the certificate, state its scope and date, and answer everything else, such as incident response or vendor risk, from your own evidence.
What does the certificate actually cover?
Cyber Essentials is a UK government recommended scheme. The NCSC developed it, and IASME, the NCSC's delivery partner, runs certification. The NCSC describes it as the minimum standard of cyber security the government recommends for organisations of any size.
It tests five technical controls:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
That is a narrow slice. A customer questionnaire with 200 rows will have perhaps a dozen that map cleanly. The rest ask about policy, people, suppliers, data handling and recovery, and the certificate says nothing on those.
Basic or Plus: which one do you cite?
There are two levels. Cyber Essentials combines a self-assessment with an independent audit. Cyber Essentials Plus covers the same controls but adds independent technical testing to check they work in practice.
Say which one you hold. A buyer who reads "Cyber Essentials certified" and assumes technical testing happened will feel misled when they find out it was the self-assessment route. The accurate wording is the level, the certificate date and the scope.
Where does the certificate map onto the questionnaire?
Treat it as a lookup, not a magic answer. Sort the questionnaire rows into three piles.
Rows the certificate supports directly: perimeter firewalls, default passwords, supported software, patching, admin accounts, antimalware. Cite the certificate and add one sentence from your own setup, for example how often you patch.
Rows it supports partly: multi-factor authentication, remote access, cloud services. The scheme covers access control, but your answer should describe what you actually run today. Do not copy scheme wording as if it were your configuration.
Rows it does not touch: secure development, vulnerability disclosure, business continuity, sub-processors, data retention. Answer these from your own policies and records, or say plainly that you do not have the control yet.
Why does scope matter so much?
A certificate applies to a defined scope. The NCSC notes that organisations can certify their whole organisation, and a narrower scope is possible. If your certificate covers the head office network and not the cloud environment where customer data lives, say so. Buyers do read the scope line, and a mismatch found in a later audit costs more trust than a modest answer given up front.
What to do
- Pull the certificate and note the level, scope and expiry date. Store one copy in your evidence folder.
- Sort every questionnaire row into the three piles above before you write anything.
- For supported rows, cite the certificate and add one specific fact from your own environment.
- For partial rows, describe your real configuration and name the scope limits.
- For uncovered rows, answer from your own policies. If a control is missing, write "not yet implemented" and the planned date only if it is already in your roadmap.
- Keep a reusable answer library so the next questionnaire starts from reviewed text, not from memory.
- Have someone other than the author check each answer against evidence before it ships.
Tools can help with step 6. Safeguard's compliance automation includes questionnaires and evidence tabs, so approved answers and the records behind them can sit in one place. The framework itself is what you are certifying against, and no tool certifies you on your behalf.
Is there anything else the NCSC offers?
The NCSC page lists the question set, a readiness tool and a free consultation with an NCSC-assured Cyber Advisor for small and medium-sized businesses. Use the question set early. It is a cheap way to find gaps before a customer's questionnaire does.
Quick check
Can I say we are Cyber Essentials compliant if we have not certified?
No. Compliant, aligned and certified are different claims. If you have not been assessed, say you follow the controls and have not been certified, or leave it out.
Does Cyber Essentials replace SOC 2 or ISO 27001 answers?
No. It covers five technical controls. Other frameworks cover management systems, audits over time and wider risk topics. Answer each questionnaire row from the evidence you hold.
Sources
Last reviewed: 18 October 2026.
