Cyber Essentials Knowledge & Assessment
A practical SPI learning and project tool for understanding the UK Government-backed Cyber Essentials scheme and preparing an organisation for assessment. Learn the five technical controls, define scope, record evidence, identify gaps and manage actions. This tool supports readiness; it does not provide Cyber Essentials certification.
What is Cyber Essentials?
Cyber Essentials is the UK Government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It is designed to help organisations protect themselves against common internet-based cyber attacks through five technical controls.
The five controls
🔥 Firewalls
Protect devices and networks from unauthorised access from the internet.
⚙ Secure configuration
Reduce vulnerabilities by securely configuring devices, accounts, software and services.
🔄 Security update management
Keep supported software and devices appropriately updated against known vulnerabilities.
👤 User access control
Give people only the access they need and protect privileged accounts.
🛡 Malware protection
Prevent malicious software from executing or causing harm using appropriate controls.
Readiness journey
Scope is fundamental
An assessment can only be meaningful when the organisation clearly understands what is included. Under v3.3, cloud services hosting organisational data or services are in scope; exclusions should be justified and segregation explained.
Consider
- Internet-connected networks and boundary devices
- Laptops, desktops, servers, mobile devices and relevant home-working equipment
- Cloud services: SaaS, PaaS and IaaS
- Operating systems and applications
- Remote access and administrative interfaces
- BYOD where it can access organisational data/services
- Publicly available commercial web applications where applicable
- Third-party managed systems and shared-responsibility boundaries
Asset discovery checklist
The Five Technical Controls
| Control | Intent | Practical checks | Useful evidence |
|---|---|---|---|
| Firewalls | Prevent unauthorised access to/from the internet. | Boundary and host firewalls enabled; inbound rules justified; admin interfaces protected; default credentials changed. | Firewall configuration, rule review, screenshots/exports, device inventory. |
| Secure configuration | Remove insecure defaults and unnecessary attack surface. | Unused accounts/software/services removed; auto-run controlled; authentication required; device locking configured. | Build standard, MDM/GPO policy, configuration records, sampled device settings. |
| Security update management | Prevent exploitation of known vulnerabilities. | Supported software; vulnerability/security updates applied within required timescales; high-risk issues prioritised. | Patch reports, software inventory, vulnerability records, update policies. |
| User access control | Limit access and privilege. | Unique accounts; least privilege; admin separated where appropriate; MFA used where required; access removed promptly. | Account lists, access reviews, MFA configuration, leaver records. |
| Malware protection | Stop untrusted/malicious code. | Approved anti-malware, application allow-listing or sandboxing approaches as applicable; web/email protections considered. | Endpoint management console, policy, protection status and sampled devices. |
Cyber Essentials
The organisation completes a verified self-assessment against the scheme requirements. The answers are reviewed through the official certification process and signed off by an appropriate senior person.
Cyber Essentials Plus
CE+ covers the same five controls but adds independent technical testing of systems to provide greater assurance that the controls work in practice.
Important distinction
Cyber Essentials is not a substitute for a full information security management system, penetration-testing programme, incident-response capability or wider risk-management framework. It is a focused baseline against common cyber threats.
Evidence-based readiness
Document
Policies, standards, procedures, asset registers and defined responsibilities.
Configure
Technical settings showing the intended control is actually enabled.
Sample
Check representative devices, accounts and services rather than assuming fleet-wide compliance.
Report
MDM, endpoint, patching, vulnerability, identity and firewall reports.
Trace
Demonstrate joiner/leaver, administrator approval, patch exception or firewall-change examples.
Verify
Challenge the evidence: is it current, complete, representative and within scope?
Supply-chain assurance
Cyber Essentials can be used as a supplier assurance requirement. Buyers should define the contractual requirement, scope, certification level and how evidence is maintained.
- Record supplier CE / CE+ status and expiry.
- Verify certificates through the official certificate search.
- Define whether whole-organisation or relevant-scope certification is required.
- Flow cyber requirements through the supply chain where contractually required.
- Assess higher-risk suppliers beyond CE where the information, service or threat warrants it.
Supplier review questions
Official Cyber Essentials Resources
Use these official sources for current requirements and certification. They open in a new tab.
NCSC — Cyber Essentials Overview ↗
Official scheme overview, five controls and certification routes.
NCSC — Help & Resources ↗
Current requirements, readiness resources and official downloads.
Requirements for IT Infrastructure v3.3 ↗
Current technical requirements effective 27 April 2026.
IASME — Danzell Question Set ↗
Official delivery-partner page for the current assessment question set.
IASME — Cyber Essentials ↗
Official NCSC Delivery Partner information and certification route.
IASME — Help & Resources ↗
Readiness, certification bodies, Cyber Advisors and support resources.
Assessment Project
Best Practice Example Project
Load a realistic worked example for a fictional UK engineering SME. It demonstrates good evidence notes, a mostly mature control environment, genuine gaps, owners and corrective actions. Use it to understand what a well-managed readiness project can look like.
Cyber Essentials Readiness Assessment
Assess implementation against practical control themes. Select Compliant only when you have objective evidence.
| Control | Assessment question | Status | Evidence / notes |
|---|
Gap & Action Plan
| Action | Owner | Due | Priority | Status |
|---|
Readiness Summary
Before official submission
- Confirm the current NCSC requirements and IASME question set.
- Revalidate scope and asset inventory.
- Resolve non-compliant items or understand the official requirement.
- Check evidence is current and representative.
- Ensure assessment answers accurately describe the real environment.
- Use the official IASME certification process / authorised Certification Body.