Cyber Essentials readiness: how to pass first time under v3.3

What Cyber Essentials is and why it matters

Cyber Essentials is the UK government-backed scheme that shows an organisation has a set of basic technical controls in place. The NCSC calls it the minimum standard of cyber security the government recommends for organisations of all sizes. It targets common attacks from the internet, such as password guessing, unpatched software and malware.

The NCSC writes the requirements. IASME, the NCSC's Cyber Essentials Delivery Partner, runs the scheme through a network of Certification Bodies it licenses.

Who asks for it

• Government contracts. Under Procurement Policy Note 014, central government departments, their executive agencies and non-departmental public bodies require Cyber Essentials or Cyber Essentials Plus for certain contracts. These include contracts where a supplier handles personal information about citizens or government staff, or supplies ICT systems that store or process OFFICIAL data.
• Supply chains. The NCSC notes that a growing number of organisations require suppliers to be certified before they can bid for work.
• Insurers. A cyber insurance application may ask whether you are certified, or about the same controls.

Passing first time avoids a delay on a contract or tender that is waiting for your certificate.

What changed in April 2026: v3.3 and the Danzell question set

The current requirements are the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026. The self-assessment questions that go with them are IASME's Danzell question set, which replaced the Willow set. According to IASME, the changes apply to assessment accounts created after 26 April 2026. Accounts opened before then had six months to finish on the previous version.

The changes that matter most for a small organisation:

• Cloud services can't be excluded. v3.3 adds a definition of cloud services and states plainly that if your data or services are hosted on them, they must be in scope.
• Missing multi-factor sign-in on a cloud service is an automatic fail. Authentication to cloud services must always use multi-factor authentication (MFA) where it is available. IASME confirms that not having it fails the assessment.
• The 14-day rule is an automatic fail. IASME's questions on installing critical and high-risk updates within 14 days, one for operating systems and router or firewall firmware and one for applications, now fail the assessment if you can't answer yes.
• Passwordless sign-in is defined. Passkeys and other passwordless methods are described, and FIDO2 authenticators count as MFA.
• Scope wording is tighter. The words "untrusted" and "user-initiated" were removed from the internet-connection criteria. If you leave part of your network out, you must justify it and show it is segregated. Every legal entity in scope must be listed.
• The director's declaration goes further. The person who signs now also acknowledges that the organisation must keep meeting the requirements for the whole certificate period.

The automatic fails, and what else stops a pass

An assessor marks your self-assessment answers. Since April 2026, IASME has confirmed two areas where a non-compliant answer fails the assessment on its own:

1. Multi-factor sign-in missing on a cloud service. It counts wherever the service offers MFA, whether it is free, included in your plan or a paid extra. Every user and every admin needs it.
2. Critical or high-risk updates not installed within 14 days of release. This covers operating systems, router and firewall firmware, and applications. v3.3 defines critical or high risk as a CVSS v3 base score of 7 or above, or a vendor rating of "critical" or "high risk". Updates where the vendor gives no severity details count too.

Other requirements are just as firm. They are not labelled automatic fails, but we treat each as a must-fix before you submit:

• Unsupported software in scope, such as an old version of Office or Windows 10 without Extended Security Updates. Windows 10 Home and Pro reached end of support in October 2025. Unsupported software must be removed, or moved into a separate sub-set that has no traffic to or from the internet.
• Admin accounts used for email and web browsing, or everyday accounts with admin rights on their own computer.
• A device in scope with no working malware protection.
• A laptop with its software firewall switched off.
• A router or firewall still using its default admin password.

Some Certification Bodies allow a short window to amend answers during marking. Plan as if yours will not.

Scope: decide what is in before you answer anything

Settle scope first, because every later answer depends on it. v3.3 asks you to cover the whole of the IT used to run your business or, if necessary, a well-defined and separately managed sub-set: part of the organisation whose network is separated from the rest by a firewall or VLAN. You must agree the scope with your Certification Body before the assessment begins.

The rules a small organisation most needs to know:

• Cloud services are always in. If your data or services are hosted there, they are in scope. That includes Microsoft 365 or Google Workspace, and accounting, payroll and file-sharing services.
• End-user devices are always in. v3.3 says a scope that doesn't include them isn't acceptable.
• Home workers' devices are in. Their own broadband routers are not, unless you supplied them. That is why the software firewall on each laptop matters.
• Personal devices that reach work data are in. A phone used only for calls, texts and an authenticator app is out.
• Supplier access is in. Accounts your IT provider uses on your systems are your accounts, and must meet the same controls.
• Network equipment and servers are in, including cloud servers you manage yourself.

A whole-organisation scope is the simplest, and v3.3 notes it gives customers the most confidence. Under Danzell you must describe any areas you leave out; IASME says that description is not made public.

You are ready when you have a written scope listing every legal entity, site, network, device type and cloud service included, with a short reason for anything left out.

The five controls at a glance

v3.3 organises the requirements under five technical controls. Scope comes first because the controls apply to everything inside it.

Readiness checklist, control by control

Work through these questions with whoever looks after your IT. Treat "don't know" as "no" until someone has checked.

Firewalls

What to check

• Does every office network sit behind a router or firewall that blocks unrequested connections from the internet?
• Have the default admin passwords on every router and firewall, including any you gave home workers, been changed to strong, unique ones, or remote admin switched off?
• Is the admin page closed to the internet, or protected by MFA or an IP allow list where there is a documented need?
• Is every inbound rule approved and documented with its business reason, and removed when no longer needed?
• Is the software firewall on, on every laptop and desktop, wherever it is used?

You are ready when every open port has a recorded approver and reason, and every computer reports its firewall as on.

Secure configuration

What to check

• Have unused, guest and default accounts been removed or disabled?
• Has software that isn't needed been removed from devices and servers?
• Does every device need a password, PIN or biometric to unlock? Where a PIN only unlocks the device, is it at least 6 characters?
• Do devices lock, or slow down repeated attempts, after no more than 10 wrong guesses?
• Is auto-run switched off, so files can't run without the user choosing to open them?
• Have default passwords been changed on printers, network storage, Wi-Fi and admin consoles?

You are ready when every device has a lock, protection against password guessing, and only the accounts and software it needs.

Security update management

What to check

• Is all software licensed and still supported by its maker, and do you know when support ends for each operating system you use?
• Is anything unsupported still in scope, such as old Windows, Office, phones or router firmware?
• Are automatic updates switched on wherever the software allows it?
• Are critical and high-risk updates installed within 14 days on every device, for operating systems, applications and router or firewall firmware?
• Does someone check each month that updates actually installed?

You are ready when an update report shows no device with a critical or high-risk update more than 14 days old, and nothing in scope is out of support.

User access control

What to check

• Does every person have their own account, created through an approval step?
• Are leavers' accounts removed promptly, and accounts disabled after a set period without use?
• Is MFA on for every cloud service, for every user and every admin, wherever the service offers it?
• Do admins use a separate account only for admin tasks, and do everyday accounts have no admin rights, even on their own computer?
• Do password settings enforce MFA, or at least 12 characters, or at least 8 characters with common passwords blocked?
• Are your IT provider's accounts named, protected by MFA and removed when the work ends?

You are ready when a sign-in report shows MFA for every account on every cloud service, and admin accounts are few, separate and reviewed.

Malware protection

What to check

• Is anti-malware installed, switched on and kept up to date on every Windows and macOS computer and server?
• Does it block connections to malicious websites, not only scan files?
• Where you use application allow listing instead, can only approved, signed applications run?
• Can phones and tablets that reach work data install apps only from the official stores?
• Are email attachments scanned, with dangerous file types blocked?

You are ready when every device in scope shows active, up-to-date protection, and web protection is switched on.

How certification works

1. Choose your route. You can register directly through IASME, or work with a Certification Body licensed by IASME. Either way, a qualified assessor marks your answers.
2. Answer the self-assessment. IASME requires answers to be entered on its assessment platform. You have six months from the date of application to pass.
3. A director signs the declaration. A board member or equivalent confirms the answers and the commitment to keep meeting the requirements during the certificate period.
4. An assessor marks the answers. If they meet the requirements, you are certified.
5. Renew every year. Cyber Essentials is an annually renewable scheme. Suppliers on government contracts under PPN 014 must recertify every 12 months to keep a valid certificate.

Cyber Essentials or Cyber Essentials Plus?

Both cover the same five controls. Plus adds a technical audit: vulnerability scans, and checks on sample devices for updates, malware protection, admin rights and MFA. PPN 014 points to Plus where the risk is higher.

The Plus audit must be completed within three months of your Cyber Essentials certificate. Since April 2026, IASME requires your self-assessment answers to stay unchanged once Plus testing starts. If sampled devices fail the update test, you fix them and are retested on those devices plus a new sample; failing again revokes your Cyber Essentials certificate too. Our Cyber Essentials Plus pre-audit guide covers the tests in detail.

How Cybervis Ready prepares you, and when to get help

You can prepare on your own with the NCSC requirements and the IASME questions. Outside help is worth considering when:

• a contract or tender has a deadline and you can't afford a failed first attempt
• nobody in-house is sure how Microsoft 365, Intune or your router are set up
• you want your IT provider's work checked against the requirements
• you have Windows 10 PCs, personal devices or home workers and aren't sure how they affect scope

Preparing first means you know whether you would pass before you pay the certification fee, with the fixes in order and your scope and policies written down.

How CORE works

CORE is our Cyber Essentials readiness assessment. Its 44 plain-English questions cover scope and the five controls, based on v3.3 and Danzell. You answer them in one session with a consultant and whoever looks after your IT. You get a rating straight away (ready to submit, nearly ready or not ready) with the automatic-fail items listed first.

• Report, from £395. The assessment session, a readiness report with the automatic-fail items first, a document pack filled in with your details (scope, firewall record, update and access policies) and a results call.
• Verified, from £995. Everything in Report, plus read-only checks of Microsoft 365 and Intune, approved by your administrator, and evidence checked for every automatic-fail item.
• Fix, from £1,950. Everything in Verified, plus we fix the settings with you, each change agreed first, help with the self-assessment and submission, and check again before you submit.

Prices are for up to 25 staff and exclude VAT. The certification fee is paid to the Certification Body. We prepare you; only an IASME-licensed Certification Body can certify you. See the CORE page for details, or find the right service for your situation.