Yes, partly. Cyber Essentials is a UK scheme built on five technical controls, and its basic level is a self-assessment signed off by a senior person. You can automate the data behind your answers, such as device and software lists, update status and account reports. You cannot automate the accountable sign-off.
What is Cyber Essentials, exactly?
The NCSC describes it as the minimum standard of cyber security recommended by the UK Government for organizations of all sizes, aligned to five technical controls. IASME, the NCSC's delivery partner, says it is an annually renewable certification scheme. The five controls are firewalls, secure configuration, security update management, user access control and malware protection.
There are two levels. Cyber Essentials combines a self-assessment with independent review: a board member or equivalent signs off your answers and an assessor marks them. Cyber Essentials Plus adds more rigorous independent technical testing, and you contact a certification body directly for it.
Where does evidence matter in the basic level?
The assessment platform asks questions, and a senior person confirms the answers are accurate. The risk is accuracy, not paperwork volume. A wrong answer about how many devices you own, or which operating systems are out of support, means you certify something untrue.
So the useful automation is anything that replaces memory with data. For Plus, the same data helps because a technical tester samples real devices and checks them.
Which data maps to which control?
Rather than a checklist copied from a vendor, use the five controls as headings and ask what system already knows the answer.
Firewalls. Export firewall or router rule sets and the list of internet-facing services. Review the export and remove stale rules before you answer.
Secure configuration. Your device management tool can report encryption, screen lock, default accounts and installed software. Pull that report on the day you answer.
Security update management. Operating system and application patch status per device, plus a list of software that is past end of support. For software you build, the equivalent is your dependency list and its known vulnerabilities. This is where Safeguard fits: it can generate an SBOM and scan dependencies for known vulnerabilities, and results can be exported, which gives you a dated record for your own applications.
User access control. An account listing from your identity provider, the admin accounts separated from daily accounts, and multi-factor authentication status.
Malware protection. Endpoint protection status per device, from the management console.
Check the exact wording against the current Requirements for IT Infrastructure document from IASME before you answer, since requirements change between versions and we did not copy their detailed rules here.
What should you not automate?
The decision to certify, the scope boundary, and the sign-off. Scope is where most of the risk sits: the assessment covers the in-scope boundary you declare, and a narrow scope that leaves out your real systems helps nobody. Have a person own the scope statement and review it with the board member who signs.
Also avoid screenshots of dashboards as your only record. They age quickly. Save machine exports with a date in the file name.
How should you run the evidence process?
Run it as a small monthly job, not an annual panic. Each month, export the five data sets, store them in a dated folder, and note exceptions with an owner. When renewal comes, you answer from current data and your exceptions list already shows what you fixed.
What to do
- Download the free question set and the Requirements for IT Infrastructure from IASME.
- Declare the scope boundary in writing and agree it with the person who will sign.
- List the data source for each of the five controls.
- Schedule a monthly export of device, software, update and account reports.
- For software you build, add an SBOM and dependency scan to the same monthly folder.
- Track exceptions with an owner and due date.
- Answer the assessment from the exports, and keep them with the submission record.
Quick check
Does Cyber Essentials expire?
IASME describes it as an annually renewable scheme, so plan to repeat the assessment each year.
Can software certify me for Cyber Essentials?
No. Tools can produce data about your devices and software, but certification comes through the assessment route and a qualified assessor.
Sources
Last reviewed: 18 October 2026.
