Which policies and documents do you need for Cyber Essentials?

You need very few documents for Cyber Essentials. The scheme certifies five technical controls through a self-assessment question set that a board member signs, so what matters is accurate answers and a small set of records that back them up: an asset list, a configuration baseline, an access list, a patch record and a malware protection record.

What does Cyber Essentials actually assess?

The UK National Cyber Security Centre describes five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certification comes in two levels. Cyber Essentials combines a self-assessment with an independent review of your answers. Cyber Essentials Plus covers the same five controls but adds hands-on technical testing by an assessor to confirm they work in practice.

You can go self-led, registering through IASME and answering the questions yourself, or supported, with a licensed Certification Body helping you read the questions. In the self-led route a board member or equivalent signs off the answers and an assessor marks them. The NCSC page points to a free question set and a free readiness tool, and it does not prescribe a list of policies. That is the key point: the scheme is about whether the controls exist and work, not whether you wrote a document for each.

Which documents are worth writing?

Write the ones that make your answers provable the next time someone asks. Keep each to a page or two.

1. Scope statement. Which offices, networks, cloud services, laptops, phones and servers are in the assessment. Everything that touches your data and the internet needs a decision: in, or out with a reason.
2. Asset register. Devices and software with an owner, operating system and support status. Unsupported software is a classic reason to fail, so mark end of life dates.
3. Boundary and firewall record. Where your boundary firewalls or equivalent cloud settings sit, which inbound ports are open, who approved each rule and why.
4. Secure configuration baseline. What a standard laptop or server looks like: default passwords changed, unused accounts and services removed, auto-run off, screen lock on.
5. Patch and update procedure. How quickly updates are applied and how you prove it. A short written rule plus a report from your device management tool is enough.
6. Access control procedure. How accounts are requested, approved, reviewed and removed, who has admin rights, and where multi-factor authentication is enforced.
7. Malware protection record. Which protection is on which device class, and how unapproved software is blocked or limited.

Notice that none of these is a policy in the heavy sense. They are working records. If one reads like it was written for an auditor and nobody follows it, rewrite it to match what people really do.

What order should you do this in?

Start with scope and the asset register, because every question in the set depends on them. Then walk through the five controls and fix gaps before you answer. Answering first and fixing later is how teams end up signing statements that are not true.

Do the fixes that come up most often early: remove or replace unsupported software, enforce multi-factor authentication on cloud services and admin accounts, close unneeded open ports, and turn on automatic updates. Then collect the records, answer the question set, have the board member read it properly, and submit.

If you plan Cyber Essentials Plus, treat the self-assessment answers as a promise the assessor will test. Run a sample of your own devices through the checks before the assessor does: scan the internet facing addresses, try the standard user account on a laptop, and attempt to run an unapproved file.

What mistakes cost people a pass?

• Scoping out the awkward systems and then finding they are reachable from in-scope ones.
• Forgetting personal devices and contractor laptops that access company data.
• Leaving a default admin login on a router or camera.
• Claiming a patch window the tooling cannot prove.
• Leaving the board sign-off to someone who never read the answers.

What to do

1. Write the scope statement and list every device and cloud service in it.
2. Build the asset register and mark anything out of support.
3. Fix gaps against each of the five controls before answering.
4. Save one record per control: a firewall rule export, a baseline, an access list, an update report, a protection status report.
5. Answer the question set honestly and get the board member to review it.
6. Diary a yearly renewal and a quarterly check of the asset register.

Quick check

How Safeguard helps automate this

Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. For a scheme like this one, that means the patch record and software inventory can come from connected systems and your real code and dependencies (scans, SBOMs, reachability) instead of a screenshot taken the week before assessment. Monitoring keeps running between renewals, so a device that drifts out of support is noticed early. Safeguard's agent can also open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. The assessment itself is done by an independent party. Safeguard helps you prepare and keep evidence ready. Book a call to see it.

Sources

• NCSC Cyber Essentials overview, fetched 18 October 2026

Last reviewed: 18 October 2026.