First timers most often stumble on scope, cloud services, unsupported software, the 14 day patch rule, shared or over-privileged admin accounts and missing multi-factor authentication. Cyber Essentials is a short assessment, but the questions are literal, so a small gap in one answer can mean a fail. This guide lists the mistakes in the order they usually bite.
How does the process work?
The NCSC describes two routes. Self-led means you register with the delivery partner IASME, pay, complete a verified self-assessment, have the answers signed off by a board member or equivalent, and an assessor marks them. Supported means you hire a licensed certification body to help you understand the questions. The NCSC also publishes the question set and a free Readiness Tool, and the requirements document sets out each control. Cyber Essentials Plus adds independent technical testing.
Which mistakes come up, and what fixes them?
1. Scoping too narrowly. The requirements say a scope that excludes end user devices is not acceptable, and that cloud services holding your data cannot be excluded. Partial scopes need a justification. Fix: define scope as the whole organisation unless you have a clear business unit boundary, and discuss any partial scope with the certification body first.
2. Forgetting cloud services. Version 3.3 adds a definition of cloud services and states they cannot be left out. Fix: list every SaaS and platform that holds business data, then check MFA and account controls on each.
3. Unsupported software left running. Software must be licensed and supported, and removed or isolated from the internet when support ends. Fix: inventory operating systems and applications on every device, including the old laptop in a drawer and the forgotten server.
4. Patching on a vague schedule. Updates for vulnerabilities rated critical or high (CVSS v3 base 7 or above, or vendor described) must be applied within 14 days of release. If a vendor bundles fixes and any one is high, the 14 day rule applies to the whole update. Fix: turn on automatic updates and report weekly on exceptions.
5. Default passwords and open admin interfaces. The firewall and secure configuration requirements cover changing default administrative passwords and not exposing management interfaces to the internet. Fix: check routers, firewalls, printers and anything with a web admin page.
6. Everyday work on admin accounts. The user access control section expects administrators to use separate accounts for administrative tasks. Fix: create admin accounts that never read email or browse.
7. MFA gaps. Fix: enforce MFA on cloud services and on administrative accounts, and write down where you rely on it.
8. Home working blind spots. Personal and home devices used for work are in scope when they access organisational data, subject to the rules in the document. Fix: either manage them or stop them accessing company data.
9. Answering from memory. Someone says "yes, we patch" without looking. Fix: sample five devices before you answer each question.
10. Skipping the board sign-off conversation. The answers are signed off by a board member or equivalent, which means they are accountable. Fix: walk them through the answers and the evidence before submission.
11. Using an old version. The current requirements, version 3.3, took effect on 27 April 2026, and applications started earlier can follow 3.2. Fix: download the version that applies to your application date and use the matching question set.
How long should preparation take?
The NCSC does not give a duration, and it varies with how many devices and cloud services you have. Estimate by counting devices, accounts and cloud services, then multiplying by the time your tooling needs per item.
What to do
- Download the current question set and requirements.
- Decide scope and write it down in one page.
- Build device, software and cloud service inventories.
- Remove or isolate unsupported software and fix default passwords.
- Turn on automatic updates and confirm the 14 day rule with a report.
- Separate admin accounts and enforce MFA.
- Run the NCSC Readiness Tool, then answer the questions with evidence open.
- Brief the signer and submit.
Quick check
Who signs off the Cyber Essentials self-assessment?
A board member or equivalent, according to the NCSC's description of the self-led route. The answers are then marked by an assessor.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five technical controls. Plus adds independent technical testing of your systems to verify the controls work in practice.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring keeps running after submission, which frees the team for other work. If you ship software, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. The assessor decides whether you pass.
Open the framework mapping demo or book a call.
Sources
- NCSC Cyber Essentials overview
- NCSC Cyber Essentials help and resources
- Cyber Essentials Requirements for IT Infrastructure v3.3
Last reviewed: 18 October 2026.
