To pass Cyber Essentials, define your scope, bring devices, accounts and cloud services in line with the five technical controls, gather evidence for each, and complete the self assessment that a board member signs and an assessor marks. Cyber Essentials Plus adds independent technical testing that checks the controls work.
What is the scheme?
The UK National Cyber Security Centre developed Cyber Essentials. IASME is the official delivery partner and licenses certification bodies that assess organizations. The NCSC page lists five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Both levels cover the same controls. Cyber Essentials is a verified self assessment signed off by a board member or equivalent and marked by an assessor. Plus adds technical testing by an independent party.
Which requirements version applies?
Secondary sources report that an updated requirements set, named Danzell and numbered v3.3, applies to new assessments from late April 2026, and that IASME published the requirements document in November 2025. Download the current Requirements for IT Infrastructure and the question set from NCSC or IASME and work from those, because question wording and auto fail items change between versions.
How do you set scope?
Decide whether to certify the whole organization or a subset. A smaller scope is easier, but it must be a clearly bounded part of the network. Secondary sources report that cloud services can no longer be excluded from scope under the newer version, so list every cloud service in use. Build an inventory of devices (laptops, phones, servers, network equipment), user accounts including admin accounts, and cloud services.
What does each control require in practice?
- Firewalls: a boundary firewall or host firewall on every in scope device, default deny for inbound connections, and no open admin interfaces to the internet.
- Secure configuration: remove unnecessary software and accounts, change default passwords, screen lock on devices, and a recorded standard build.
- Security update management: supported operating systems and applications only, automatic updates where possible. Secondary sources report that high risk or critical updates must be installed within 14 days of release, so confirm the exact rule in the current document.
- User access control: individual accounts, admin rights limited to those who need them, strong passwords, and multi factor authentication for cloud services where it is offered. Secondary sources report that offered MFA must be enabled.
- Malware protection: anti malware or application allow listing on applicable devices, kept updated.
What evidence should you gather?
Collect exports, not opinions: a device list with operating system versions and update status, firewall configuration screenshots or exports, a list of admin accounts with reasons, MFA settings for each cloud service, malware protection status, and your build standard. Date everything. Keep these for the assessor and for the Plus test, where evidence of real settings matters more than descriptions.
How does the assessment go?
Fill in the question set honestly. The signer should read it, since the sign off is by a board member or equivalent. The assessor marks answers; an auto fail item stops the pass until it is fixed. Plus involves independent technical testing on a sample of devices and checks that controls work in practice. IASME's materials include a free preview of the question set and a readiness tool, which are worth using before you pay for an assessment.
What mistakes cost people the pass?
Unsupported operating systems left in scope, shared admin accounts, cloud services missing from the inventory, MFA turned off where it exists, and a scope statement that does not match the devices in use.
What to do
- Download the current requirements and question set.
- Decide scope and inventory devices, accounts and cloud services.
- Remove or replace unsupported software.
- Turn on host firewalls and review boundary rules.
- Enable MFA on every cloud service that offers it.
- Limit and document admin accounts.
- Check update status and malware protection across devices.
- Collect dated evidence and have the board member review the answers.
- Book the assessment and, if needed, Plus.
Quick check
What is the difference between Cyber Essentials and Plus?
Both cover five controls. Plus adds independent technical testing that verifies the controls work in practice.
Who signs off the self assessment?
A board member or equivalent, according to the NCSC page.
How Safeguard helps automate this
Patch status and software inventory are the controls that drift fastest. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between assessments, saving your team time for other work. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, which helps with security update evidence for software you build. The agent can open tested fix pull requests for vulnerable dependencies, but it is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence; the certification body decides the result. See the mapping demo below or book a call.
Open the framework mapping demo
Sources
Last reviewed: 18 October 2026.
