Can you do Cyber Essentials with spreadsheets, and when to automate?

Yes, a small organisation can prepare for Cyber Essentials with a handful of spreadsheets: a device and software inventory, an account list, a patch log and the free question set. Automate when the lists go stale faster than you can update them, or when you must renew every year with a growing estate.

What is Cyber Essentials?

The UK National Cyber Security Centre describes Cyber Essentials as a certification scheme aligned to five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. On its overview page, fetched 18 October 2026, the NCSC says these controls are designed to prevent the most common internet based threats.

Two certification levels exist. Cyber Essentials combines self assessment with independent audit of your answers. Cyber Essentials Plus assesses the same five controls but adds independent technical testing that verifies they are working in practice.

There are two routes to certify. In the self led route, you register through IASME, the NCSC's delivery partner, complete a verified self assessment, have it signed off by a board member or equivalent, and an assessor marks it. In the supported route, you hire a licensed certification body to help you understand the questions. The NCSC also publishes the question set for free and offers a readiness tool, so you can preview before paying.

Which spreadsheets do you need?

Keep it to five tabs in one workbook, with an owner for each.

1. Scope. The organisation or the part of it being certified: locations, networks, home workers, cloud services, and what is excluded and why. Certifying a narrow scope is allowed in the scheme, but check the current requirements document before you decide.

2. Devices and software. Every laptop, desktop, phone, tablet, server and network device in scope, with owner, operating system and version, support status, and encryption and malware protection status. Add installed business software and its version.

3. Accounts and access. All user accounts and administrator accounts, with role, whether admin rights are needed, whether multi factor authentication is on, joiner and leaver dates and last review. Include cloud service accounts.

4. Firewalls and configuration. Each boundary firewall or router and each device firewall policy, with default password changed, open ports with business reasons and where the settings are exported.

5. Updates. Operating system and application patch status by device, with dates applied and exceptions for anything unsupported or unpatched.

Then keep the question set in a sixth tab or a separate document, with each answer pointing to the evidence tab that supports it.

What does the spreadsheet approach do well?

It is cheap, visible and easy for non specialists to follow. For ten to thirty devices it works, and it forces you to look at what you actually own, which is the real work of the scheme. The questions are about practice, and a clear inventory answers most of them.

Where does it start to break?

• Lists drift. Someone buys a laptop, a leaver keeps an account, an app updates itself, and the sheet is wrong a week later.
• Evidence is manual, so each renewal repeats a day of exports and screenshots.
• Remote and hybrid staff mean devices you never see.
• Cyber Essentials Plus tests devices technically, so out of date inventory turns into surprises during the test.
• Several people editing, no history.

When should you automate?

Use these triggers.

• More than about thirty devices, or staff on personal devices.
• You cannot say today, within a day, which devices are unpatched.
• You renew yearly and dread it.
• Customers now also ask for other frameworks that reuse the same evidence.
• You are aiming for Cyber Essentials Plus.

Automation means pulling the inventory, patch status, account list and configuration from device management, the identity provider and cloud consoles, on a schedule, so the sheet becomes a report instead of a chore. Keep spreadsheets for the scope decision and the narrative answers.

What mistakes should you avoid?

• Leaving out personal phones or home devices that access company data.
• Unsupported operating systems nobody noticed.
• Admin accounts used for email and browsing.
• Answering from policy instead of from what is actually configured.
• Letting the board sign off without reading the answers.

What to do

1. Download the free question set and read it end to end.
2. Build the five tab workbook and name an owner for each tab.
3. Fix issues as you find them: patch, remove accounts, close open ports.
4. Map every answer to evidence in the workbook.
5. Choose self led or supported based on your confidence.
6. Have a board member or equivalent read and sign off the answers.
7. After certification, calendar a monthly list refresh and a pre renewal check.

Quick check

Sources

• NCSC, Cyber Essentials overview, fetched 18 October 2026. Check it for current costs and requirements, which we do not repeat here.

How Safeguard helps automate this

Spreadsheets break at the software layer first: what is installed, which versions and which are vulnerable. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs continuously between renewals, saving time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready; certification is granted through the scheme's assessors. Book a call.

Last reviewed: 18 October 2026.