Cyber Essentials is the UK government's minimum standard for cyber security. It covers five technical controls and can be achieved through a self-assessment route followed by independent verification — a process designed for businesses without a dedicated IT team.

The process is straightforward in theory. In practice, most SMEs find the questionnaire more demanding than expected, particularly around evidence and supporting documentation. This guide walks you through what the self-assessment actually involves, what the five controls require, and how to prepare your answers so the process runs smoothly.

According to GOV.UK, over 215,000 Cyber Essentials certificates have been issued since the scheme launched in 2014, including 49,248 in the past 12 months alone. The vast majority of those certificates have been awarded to organisations of fewer than 50 employees. The self-assessment route is the default path for most SMEs.

What is the Cyber Essentials self-assessment process?

Cyber Essentials self-assessment (formally "Cyber Essentials Verified") works as follows:

1. Download the question set in advance. IASME, the NCSC's delivery partner, provides a free copy of the Cyber Essentials Question Set in PDF and Excel formats. This is for preparation only — you do not need to have purchased certification to access it.

2. Review the requirements document. The "Requirements for IT Infrastructure" document (currently version 3.2 / Willow, effective from 28 April 2025) sets out what you need to have in place across the five technical controls.

3. Prepare your answers. Work through the questionnaire on paper or in the spreadsheet. Where possible, gather supporting evidence (screenshots, configuration records, policy documents) before you enter answers into the assessment portal.

4. Register and pay. Once you are ready to submit, register via a Certification Body on the IASME platform and pay the assessment fee. Pricing for a small organisation (10–49 employees) starts at £440 + VAT.

5. Submit your answers into the assessment portal. The portal is where the official marking takes place. You can copy and paste your prepared answers into the portal fields.

6. Obtain board-level sign-off. A director, partner, or equivalent must confirm that your answers are accurate to the best of the organisation's knowledge.

7. Await marking. Most assessors return results within three working days. If you pass, you receive a certificate valid for 12 months. If you do not pass, you receive a report identifying non-compliant answers and have two working days to correct issues and resubmit at no additional cost.

The entire process typically takes between one and four weeks once you have registered, depending on how prepared your answers and evidence are beforehand.

A point often missed during self-assessment: writing "yes" to a question is rarely enough. Assessors expect a clear sentence explaining how the control is actually implemented at your organisation. A bare answer invites a clarification request and delays your result.

What do the five technical controls require?

Cyber Essentials assesses compliance across five technical controls. Each control has specific requirements set out in the "Requirements for IT Infrastructure" document. Here is what each one demands in practical terms.

Firewalls

Your network must be protected by properly configured firewalls that restrict internet-facing access. This applies to all internet-connected devices in scope, including end-user devices, servers, routers, and wireless access points.

For SMEs using M365 as their primary platform, this means your network boundary devices (typically your broadband router or managed firewall appliance) must be configured to allow only necessary traffic. Default configurations that permit all inbound connections will not pass.

Secure Configuration

Devices must be set up securely. This means disabling unnecessary services, changing default passwords, removing unused accounts, and following recognised hardening guidance. Microsoft publishes secure configuration guidance for Windows, M365, and other platforms you are likely to use.

Many SMEs overlook the configuration of cloud services. M365 tenant settings, SharePoint permissions, and email security configurations are all within scope if they are part of the assessed environment.

Security Update Management

All software on in-scope devices must be kept up to date. This means using the latest supported versions and applying security patches promptly. If software has reached end of life and no longer receives updates, it must either be upgraded or removed from the assessed environment.

For businesses using M365, Microsoft handles platform-level patching. However, installed software on your devices (browsers, office applications, Adobe products, etc.) is your responsibility.

User Access Control

You must control who has access to your systems and data. This covers user accounts, password policies, and privilege management. Administrative accounts should be used only when necessary and protected appropriately.

Two-factor authentication (also known as multi-factor authentication) is now mandatory for all users with administrative access, including Microsoft 365 global admin accounts.

Malware Protection

All in-scope devices must have active, up-to-date anti-malware protection. This includes desktops, laptops, and servers. The software must be running, configured to scan automatically, and updated with the latest definitions.

On M365-centric organisations, this typically means Windows Defender (built into Windows 10/11) or a third-party endpoint protection product must be active on all managed devices.

What has changed with the v3.3 (Danzell) update?

From 27 April 2026, a new version of the Cyber Essentials technical requirements — v3.3, using the "Danzell" question set — will come into force for all new assessment accounts.

The five controls remain the same. The update introduces clearer wording and tighter enforcement on several points:

A 14-day patching requirement. High-risk and critical vulnerability fixes must now be applied within 14 days of release. Non-compliance with certain questions causes an automatic fail. Under the previous version (v3.2 / Willow), the requirement was to apply updates "in a timely manner" without a defined window.

Cloud services definition tightened. The new version provides clearer guidance on how cloud services should be scoped and what configuration responsibilities fall on the organisation versus the cloud provider.

Scope rules clarified. End-user devices must be included in scope. A scope that excludes end-user devices is no longer acceptable.

Director declaration updated. The board-level declaration now includes an explicit commitment to maintain ongoing compliance with the five controls.

If you plan to begin a new assessment after 27 April 2026, your submission will be assessed against v3.3. If your assessment account was created before that date, you may continue under v3.2 within your existing certification window.

The safest approach is to prepare your self-assessment against v3.3 from the outset, so that any submission date works.

How should SMEs prepare before starting the questionnaire?

The most common cause of delay in the self-assessment process is poor preparation beforehand. Here is a practical approach that most SMEs can follow:

Step 1: Inventory your environment. List every device, system, and cloud service in use — desktops, laptops, servers, routers, firewalls, M365 tenant, any cloud applications with data storage. This inventory feeds directly into the questionnaire, where you must declare which items fall within your certification scope.

Step 2: Map your inventory against the five controls. For each control, check whether you currently meet the documented requirements. Firewalls configured? Secure baselines applied? Software supported and patched? Access controlled with MFA for admins? Anti-malware active? This gap analysis is the single most valuable hour you will invest in the process.

Step 3: Draft your answers with evidence. Work through the questionnaire using the free PDF or Excel question set. For every "yes" answer, prepare a one- or two-sentence explanation of how your organisation implements that control. Gather supporting evidence where helpful: screenshots of firewall rules, screenshots of update settings, a copy of your password policy, your anti-malware console showing active protection.

Step 4: Get a second pair of eyes. This step is not required by the scheme, but it is consistently the highest-value action in the preparation process. Ask someone with technical understanding — whether an IT manager, an external consultant, or a trusted colleague — to review your answers against your asset inventory. The most common error is an internal contradiction: declaring that all devices run supported software while the inventory includes an operating system that has reached end of life.

Step 5: Reserve time for implementation fixes. If your gap analysis reveals controls that are not yet in place, build in time to implement them before you register for the assessment. Common fixes include enabling MFA on administrative accounts, updating outdated software, or ensuring anti-malware is active on all devices.

The assessment portal gives you six months to complete your submission after registration. Most SMEs can prepare their answers and get them into the portal within a week or two if the preparation is methodical.

Where can you get help with the self-assessment?

Several free and paid resources exist to support SMEs through the Cyber Essentials process.

Free resources:

• The free Cyber Essentials Question Set (PDF and Excel) is available from IASME for preparation purposes.

• The NCSC Cyber Essentials Readiness Tool provides a tailored action plan based on your current setup.

• The Cyber Advisor scheme offers free 30-minute consultations with NCSC-assured organisations that provide practical cyber security advice.

Paid support:

• Certification Bodies licence by IASME offer varying levels of support. Some provide pre-submission review of your answers, which can significantly reduce the risk of a failed submission. This tends to be the highest-value commercial engagement for SMEs undertaking self-assessment for the first time.

For businesses managing their IT infrastructure through a managed service provider, that provider may also offer preparation support as part of their existing relationship.

Why does Cyber Essentials matter for SMEs?

Beyond the headline figure of 92% fewer insurance claims from businesses with Cyber Essentials controls in place (as stated by GOV.UK), certification carries practical commercial value for SMEs.

A growing number of organisations require their suppliers to hold Cyber Essentials certification as a condition of doing business. Government contracts handling financial or personal data increasingly mandate it. It is also becoming a de facto expectation in supply chain security requirements across sectors including banking, healthcare, and professional services.

The certification also comes with free Cyber Liability Insurance for UK organisations with a turnover under £20 million that achieve certification covering their whole organisation.

Frequently Asked Questions

Can I complete Cyber Essentials self-assessment without an IT team?

Yes. The self-assessment route is explicitly designed for organisations without dedicated IT staff. The free Question Set and the "Requirements for IT Infrastructure" document provide all the guidance you need. However, many SMEs find that a second opinion on their answers — whether from an IT consultant or a managed service provider — significantly improves their chances of passing first time.

How long does it take to complete the self-assessment?

If you prepare your answers in advance using the free Question Set, filling out the assessment portal typically takes about an hour. The broader preparation — inventory, gap analysis, evidence gathering, and drafting answers — usually requires several hours of work spread across a few days.

Can I resubmit if I fail the Cyber Essentials self-assessment?

Yes. If you receive a failing result, you have two working days to address the issues identified in the assessor's report, update your answers, and resubmit at no additional cost. Beyond that window, a resubmission would require reapplying and paying the assessment fee again. This is why preparation matters: addressing known gaps before submission avoids the risk of losing that two-day correction window.

How long is a Cyber Essentials certificate valid?

Cyber Essentials certificates are valid for 12 months and must be renewed annually. Each recertification requires completing the full self-assessment process again, as the scheme expects an annual review of your cyber security controls.

Is Cyber Essentials sufficient on its own, or do I need Cyber Essentials Plus?

Cyber Essentials (the self-assessment route) confirms that your documented controls meet the five technical requirements. Cyber Essentials Plus adds an independent technical audit that verifies those controls are working in practice through hands-on testing of your systems. For most SMEs, the self-assessment route is the appropriate starting point. Cyber Essentials Plus may be required by specific clients or contracts.

Cyber Essentials self-assessment is a structured process, not a technical exam. The questions are straightforward, and the barrier to passing is preparation — knowing your environment, having evidence to support your answers, and addressing known gaps before you submit.

If you would like to understand your current position relative to the Cyber Essentials requirements, a Security Triage Call can identify your gaps and give you a clear picture of what needs attention before you begin your self-assessment.