Cyber Essentials, in plain English
44 guides for UK small businesses with no IT team, written from the current IASME question set (“Danzell”) and the NCSC requirements (v3.3), with the official question numbers wherever a rule is cited. Every guide says where it came from and when it was last updated. None of them promise a pass — only an IASME-licensed certification body can award the certificate; these help you get ready for it.
New to all this? Begin with What is Cyber Essentials? The plain-English guide, then the cost guide. Already mid-questionnaire? Go straight to the question-by-question guide or the MFA guide. Prefer a form to a paragraph? The free tools — a checklist, a cost calculator and a policy generator — run in your browser with nothing uploaded.
Understand Cyber Essentials
Start here if a client, tender or insurer has just asked for Cyber Essentials and you want to know what it is, who runs it, what it requires and what changed this year — before you spend anything.
What is Cyber Essentials? The plain-English guide
Who runs it, who needs it, the five controls, what changed in 2026, what it costs and how to get certified — no jargon.
Read the guide RequirementsThe requirements, control by control
What each of the five controls requires of a small business under v3.3, with the official question numbers — and what isn’t required.
Read the guide Basic vs PlusCyber Essentials vs Cyber Essentials Plus
Self-assessed versus verified: what differs, what doesn’t, what each costs, and how to read a contract that asks for one of them.
Read the guide 2026 updateWhat changed in Cyber Essentials in 2026
What’s genuinely new in v3.3 and the Danzell question set — and the MFA, patching, scope and password rules that still catch renewals out.
Read the guide ScopeScope: what’s in, what’s out, with worked examples
The current scope rules for devices, personal phones, home workers and cloud services — and five scope statements you can adapt.
Read the guide Do you need it?Do you actually need Cyber Essentials?
Not law — contracts. Who requires it, who benefits anyway, and the honest cases where it can wait.
Read the guide vs ISO 27001Cyber Essentials vs ISO 27001
A baseline of five controls versus a full management system with external audit — the honest comparison, and which to do first.
Read the guide InsuranceCyber Essentials and insurance
The bundled-insurance question and the your-insurer question, separated and answered honestly — with where to check current terms.
Read the guideCost and how to get certified
The assessment fee by company size, what Plus adds, why your time is the real cost, and the route from “we need this” to a certificate, in order.
How much Cyber Essentials costs in 2026
The assessment fee by company size, what Plus adds, why time is the real cost, and what DIY, software and a consultant each involve.
Read the guide Step by stepHow to get Cyber Essentials certified
Scope, gaps, fixes, policies, certification body, questionnaire, review, renewal — in the order that actually works.
Read the guide TimingsHow long it takes, honestly
An afternoon for the form; days to weeks for readiness depending on where you start. The timelines, by starting point.
Read the guide Plus costWhat Cyber Essentials Plus costs
Quoted individually — roughly from £1,350 on top of the basic fee, by our market estimate. What drives it, the timing, and how to budget.
Read the guide Choosing helpConsultant, software or DIY?
What each route actually does, what none of them can promise, and how to choose by starting point — from the company selling one of them.
Read the guideThe self-assessment
The self-assessment itself: how it works from the inside, every scored question in plain English, how to scope it, and what renewal involves twelve months later.
The self-assessment, walked through
The three parts of the questionnaire, how it’s marked, the automatic fails, where people get stuck, and how to prepare.
Read the guide Question by questionThe questionnaire, question by question
The core technical questions in the 2026 set, in plain English, with the official number and what has to be true. Auto-fails flagged.
Read the guide Question setThe 2026 question set (Danzell): sections and download
The eight sections, A1 to A8, with a question count for each, where to download the official PDF and spreadsheet from IASME, and when Danzell replaced Willow.
Read the guide Example answersExample answers for the hardest questions
Fifteen free-text questions from the 2026 set, each with what the assessor is looking for and an illustrative answer for a made-up business — to rewrite, not copy.
Read the guide DocumentsThe documents: eleven short pages, not a binder
What written material the assessment actually expects, what each document is for, and why a few sentences each is enough.
Read the guide RenewalRenewal: what changes and how not to fail it
Renewal is a full reassessment against this year’s rules. The cost, when to start, the rules to re-check, and a checklist.
Read the guide After a failFailed? What the feedback means and what next
How assessor feedback works, the usual reasons, what resubmission involves — and how to make the second attempt the last.
Read the guideThe five controls, explained
The five technical controls one at a time — MFA, passwords, updates and the rest — with the official question numbers and what has to be true for a small business.
MFA requirements: the rule that catches businesses out
MFA is an automatic fail across three questions. The accounts businesses forget, what counts, and how to switch it on tool by tool.
Read the guide PasswordsPassword requirements: what the rules actually say
Three acceptable controls, one rule against guessing, and the things that are NOT required — plus what to tell staff and how to write the policy.
Read the guide Updates & patchingUnsupported software and Windows 10
Why an unsupported operating system fails you outright, where Windows 10 stands, how to check every device, and the three real options.
Read the guide UpdatesSupported operating systems: the rule and the current versions
What ‘supported’ means in the requirements, the Windows end dates that matter this year, how Apple and Android are judged, and how to answer A6.1 without an automatic fail.
Read the guide Updates & patchingPatching and the 14-day rule
What the 14-day rule covers, why it’s an automatic fail, why monthly patching misses it, and the settings that meet it.
Read the guide Cloud servicesCloud services: what counts and what you must do
Why cloud services can’t be excluded, what counts as one (social media included), and what you’re responsible for configuring.
Read the guide Secure configurationSecure configuration, setting by setting
Unused software and accounts, default passwords, auto-run, and screen locks — the A5 questions and the exact settings.
Read the guide Device lockingScreen locks and PINs: the unlock rules
A lock on every device, a PIN of at least 6 characters when it only unlocks the device, no more than 10 guesses — and the case where full password rules apply.
Read the guide FirewallsFirewalls: what your router must do
The boundary firewall is usually your router. The admin password, inbound rules, the yearly review and remote management — A4, translated.
Read the guide MalwareMalware protection: what actually counts
Defender counts, Macs have built-in protection, phones use the app store plus an approved-apps list — the A8 questions and the exact settings, no purchases needed.
Read the guide User accessUser access: accounts, admins and leavers
Own logins for everyone, admin accounts separate and off email, leavers out promptly, admin rights listed and reviewed — A7.1–A7.13 in practice.
Read the guide User accessShared accounts: why they fail, and the fixes
Shared logins break A7.2 outright. The fix for each usual suspect — the info@ inbox, the office PC, social media, one-seat tools, emergency admin accounts.
Read the guide BYODPersonal devices (BYOD): the in-or-out rule
In scope if it touches work data; exempt only for built-in calls, texts and two-factor codes. What an in-scope personal phone must meet, and the fair way to handle it.
Read the guide Home workingHome workers: what’s in scope and what isn’t
The home router rule, the software firewall that replaces it, VPNs, and the scope questions about remote workers — answered plainly.
Read the guide Mobile devicesPhones and tablets: the mobile requirements
Supported OS, listed in scope with versions, 6-character passcodes, official app stores and approved apps, no jailbreaks — the mobile rules in one place.
Read the guideFor the tools you use
Click-by-click guides for the tools small businesses actually run on, with the real menu names in the order you’ll click them.
Cyber Essentials with Microsoft 365
The Authenticator for each person, MFA required via security defaults, separate admin accounts, leavers and shared mailboxes — the exact clicks.
Read the guide Google WorkspaceCyber Essentials with Google Workspace
2-Step Verification for each person and enforced for all, separate admin accounts, leavers suspended — the exact clicks, and what Workspace doesn’t cover.
Read the guide macOSCyber Essentials on a Mac
Firewall on, automatic updates with Security Responses, malware protection, a locking screen, a supported macOS — the exact settings.
Read the guide Windows 11Cyber Essentials on Windows 11
Which versions still count and until when, moving 24H2 to 25H2, and the seven settings to check on each PC — updates, firewall, Defender, accounts, PIN, AutoPlay, clutter.
Read the guideWho it's for
Who Cyber Essentials is for, and what changes when you’re a sole trader, a charity or bidding for public-sector work.
Cyber Essentials for small businesses
The certificate from a 5–50-person perspective: the trigger, the cost at your size, the actual work, and doing it without an IT department.
Read the guide Sole tradersCyber Essentials as a sole trader
Scope when your laptop is the office, the micro fee tier, and the shortest honest path through the assessment.
Read the guide CharitiesCyber Essentials for charities
Same scheme, same fees by size — with volunteers’ devices, shared logins and funder requirements as the charity-shaped wrinkles.
Read the guide TendersCyber Essentials in tenders and PPN 014
What the procurement policy note actually requires, how to read tender wording, Basic vs Plus, and timing certification against a bid.
Read the guide TendersPPN 014: the procurement rule, explained
The Cabinet Office policy note behind most Cyber Essentials tender clauses — who it applies to, when it bites, and the proportionality wording suppliers can quote back.
Read the guideFree tools
Small, honest tools for the parts that are easier with a form: tick through every control, work out the real cost, generate the password policy. No account; nothing you type leaves your browser.
Cyber Essentials readiness check
Plain questions, mapped to the official question set, with a verdict across the five controls and the auto-fails flagged first. About 10 minutes.
Open Free toolCyber Essentials checklist
Every control as a tick-box, with the auto-fail items flagged. Saves in your browser; print to PDF or download as a spreadsheet.
Open Free toolCyber Essentials cost calculator
The assessment fee for your size of business, the time it takes, and what DIY, ReadyCert and a consultant each cost.
Open Free toolPassword policy generator
Answer three questions and get a one-page password & authentication policy written to the v3.3 rules — the same document ReadyCert drafts.
Open Free toolMFA gap checker
Tick the services you use, answer one question per tool, and see exactly which accounts stand between you and the user-access section.
Open Free toolRenewal planner
Enter your expiry date and get the working-back timeline: start six weeks out, auto-fails first, submit with two weeks in hand.
Open Free toolScope statement builder
Plain questions in, a scope statement out — with the home-router, BYOD and cloud-service rules applied in the wording for you.
Open