Cyber Essentials assessors expect you to define a scope, then show that five controls hold inside it: firewalls, secure configuration, security update management, user access control and malware protection. Keep an asset list, firewall rules with approvals, patch dates for the 14 day rule, MFA settings and your malware protection settings ready.
This guide follows the NCSC requirements for IT infrastructure, version 3.3, dated April 2026. Safeguard does not hold, issue or imply any Cyber Essentials certification. This is an explainer of the scheme.
How is Cyber Essentials assessed?
The scheme has two levels that assess the same five controls. Cyber Essentials is a verified self-assessment: you register through IASME, a board member or equivalent signs off your answers and an assessor marks them. You can also use a licensed Certification Body for a supported route. Cyber Essentials Plus adds independent testing of your systems. NCSC's overview page does not state how long a certificate lasts, so ask IASME or your Certification Body.
What does scope evidence look like?
Scope is where many answers go wrong, because every later answer applies to it. The requirements say end user devices must be in scope, a scope that leaves them out is not acceptable, and cloud services cannot be excluded. All accounts your organisation owns are in scope even when a supplier or managed service provider uses them. If an MSP administers your systems, you must be able to confirm the technical controls are met.
Keep a one page scope statement, a device and software inventory, a list of cloud services and a list of third party accounts.
What evidence supports each control?
Firewalls. Every in-scope device needs a correctly configured firewall. Default administrative passwords must be changed or remote administration disabled. Unauthenticated inbound connections are blocked by default, and inbound rules must be approved and documented by an authorised person with the business need written down. Unneeded rules must be removed. Evidence: the rule export, an approval record per rule and a review date.
Secure configuration. Remove or disable unnecessary accounts and services, and change default credentials. Evidence: build standards and a sample of device settings.
Security update management. All in-scope software must be licensed and supported, removed when it becomes unsupported, set to update automatically where possible, and updated within 14 days of release when the update fixes critical or high risk issues. The document defines that as vendor labelled critical or high, CVSS v3 base score of 7 or above, or no severity information from the vendor. A bundle containing any such fix counts. Evidence: an inventory with versions, end of support dates and patch install dates.
User access control. Accounts go to authorised people. MFA must be used for cloud services. Administrative accounts are separate from daily accounts, and special privileges are removed when no longer needed. Evidence: account lists, admin account list and MFA settings.
Malware protection. Keep the product settings and update status for each device type.
Where do software dependencies fit?
The 14 day rule covers software on in-scope devices. If you build and run your own applications, bespoke web application code is excluded from this assessment by the scheme, but the operating systems, runtimes and packaged components your servers run are not. A dependency inventory with versions and dates gives you the same style of evidence for libraries. Safeguard's software composition analysis produces a dependency inventory for that purpose.
What to do
- Write the scope statement and get it agreed with the Certification Body before you answer questions.
- Build one inventory listing device, software, version, support end date and last patch date.
- Export firewall rules and attach an approval and business reason to each inbound rule.
- Turn on automatic updates and record the date critical or high fixes are installed.
- Confirm MFA on every cloud service and list the people with admin rights.
- Screenshot or export malware protection status per device type.
- Have the board member who signs read the answers first.
Quick check
How fast must critical updates be applied?
Within 14 days of release for updates that fix critical or high risk vulnerabilities, defined as vendor labelled or CVSS v3 base score of 7 or above.
Can we exclude our cloud services from scope?
No. The requirements state that cloud services cannot be excluded from scope.
Sources
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials Requirements for IT infrastructure v3.3 (April 2026)
- NCSC: Cyber Essentials resources
Last reviewed: 18 October 2026.
