The Cyber Essentials paperwork: eleven short documents, not a binder
You don’t normally upload anything at the basic level — your typed answers are the assessment, though your certification body can ask for evidence. So why write anything down? Because eleven short documents make every answer consistent, true, and repeatable at renewal. Here is each one, what it answers, and how short it can honestly be.
What “required” really means here
At the basic level you don’t normally upload evidence: an assessor reads your written answers and judges them against the requirements (your certification body can still ask for evidence before certifying). No question says “attach your policy”. But many questions ask you to describe a process — how joiners get accounts, what happens when a password leaks, how updates are applied — and the difference between a confident answer and a vague one is usually whether it was ever written down. The documents below are the ones whose absence shows in the answers. For a business of five to fifty people, each is a few sentences to a page.
The eleven documents
1Scope statement
A short description of what the certificate covers: whole organisation or part, locations, devices, network equipment, cloud services. Answers the opening of section A2. (free builder)
2Asset & cloud-service register
The itemised list behind the scope statement — devices with OS versions, routers with make, model and quantity, servers, every cloud service. Feeds A2.5–A2.9 and the MFA questions. (free spreadsheet)
3Password & authentication policy
Which of the three password controls you use, MFA on every cloud service, brute-force protection, device locks — and what you deliberately don’t do (expiry, complexity). Answers A5.3, A7.10–A7.12. (free generator) Cyber Essentials password policy guide →
4Choosing good passwords — a staff note
Three random words, never reuse, use the password manager. The evidence behind “we help staff pick good passwords” (A7.12).
5Compromise process
What happens when a password or account may be compromised: who changes it, where, what gets checked. Answers A4.4, A5.6 and A7.13 in one page.
6Joiner & leaver process
Who approves new accounts, who creates them, and how fast a leaver’s access is switched off. Answers A7.1 and A7.3. (free template)
7Administrator accounts process
How admin rights are granted, the separate-account rule, the list of who has them, and how often it’s reviewed. Answers A7.5–A7.9.
8Patch management statement
Supported software only; high-risk, critical and unrated security updates within 14 days; automatic updates doing the work. The written side of A6. (free template)
9Malware protection statement
What protects each kind of device — anti-malware such as Defender on Windows computers; official app stores plus a list of approved apps on phones and tablets (A8.4, A8.5). Answers A8.
10Firewall & network statement
Boundary firewall in place and software firewalls on, admin password changed, inbound blocked, any opened rule or remote management documented with its business reason, rules reviewed. Answers A4.
11BYOD policy (if personal devices are in scope)
What in-scope personal devices must meet, the calls-texts-MFA exemption, and the company-device alternative. (free template)
How short is short enough?
The scheme rewards accuracy, not weight. “New starters get accounts after the owner approves the hire; the office manager sets them up; leavers are disabled the same day by the same person” is a complete joiner-and-leaver process for a ten-person firm — three sentences that answer two official questions and survive a year unchanged. A ten-page policy suite copied from a template reads impressively and helps nobody, least of all the assessor trying to work out what you actually do.
The order that makes them easy
Write the register first — it is facts, not prose, and it feeds the scope statement. Then do the fixes (MFA, updates, locks), because a policy can only describe what is true. The policies come last and almost write themselves: each one states what you already switched on. That is also exactly the order the step-by-step guide runs, and the checklist tracks. To check the technical answers before you write anything, print the Cyber Essentials checklist PDF and walk round the office with it.
Frequently asked questions
What documents do I need for Cyber Essentials?
You don’t normally upload any at the basic level — you answer in writing, though your certification body can ask for evidence. In practice eleven short documents make the answers consistent and repeatable: a scope statement, an asset and cloud-service register, a password and authentication policy, a staff password note, a compromise process, a joiner and leaver process, an admin accounts process, and short statements on patching, malware protection and your firewall — plus a BYOD policy if personal devices are in scope.
Do I upload policies to the Cyber Essentials portal?
Not normally. At the basic level you describe your setup in writing and an assessor reviews the answers, though your certification body can ask for evidence before certifying. The documents exist so your descriptions are consistent, true, and easy to repeat at renewal.
How long should each policy be?
For a business of five to fifty people, a few sentences to a page. The scheme rewards accuracy, not length — a paragraph everyone has read beats ten pages nobody has.
Are there free templates?
Yes — this site has free generators for the password policy, the BYOD policy, the patch management statement, the user access policy and the scope statement, plus an asset register spreadsheet. ReadyCert drafts all eleven from your assessment answers.