Cyber Essentials example answers for the questions that ask you to describe
Most of the 2026 self-assessment is yes or no. The hard part is the questions that ask you to describe something in your own words. Here are 15 of them from the Danzell question set, each with what the assessor is looking for and an example answer written for a made-up eight-person business. The examples show the shape of a good answer. They are not answers to copy: yours has to describe your own business as it is today.
Read this before you use any example
- The examples are ours, and the business is invented. They are not official wording from IASME or the NCSC, and no certification body has approved them. They are preparation guidance, written from the guidance printed under each question in the official question set.
- Replace every detail with your own. The assessor is judging whether what you describe meets the requirements, and a senior person in your business signs off that the answers are accurate. An answer that sounds right but isn’t true is worse than a plain one that is.
- Fix first, then write. If an example describes something you don’t yet do, that is a gap to close before you submit, not a sentence to borrow. Answers describe today.
- The questions are paraphrased. The official wording belongs to IASME and is linked under Sources; the number beside each one lets you find it. The question set guide shows where to download it.
The made-up business behind the examples
Eight people in one office, some working from home a couple of days a week. Eight company-owned Windows 11 laptops, a company phone each, one office router, no servers. Microsoft 365 for email and files, plus a handful of other cloud services. The owner makes the decisions and the office manager does the day-to-day IT. Your business will differ, and so will your answers.
A2 — Scope
A2.6List your laptops and desktops: how many, what make, and which operating system.
What the assessor is looking for: A count, the make and the operating system for every computer used for work — company-owned and personal. For Windows, the edition and the feature version are required, because that is how the assessor checks the version is still supported. Models, serial numbers and other technical detail are not needed.
Example answer (illustrative — replace with your own):
We have 8 Dell laptops running Windows 11 Pro, version 25H2. All are company-owned. Nobody uses a personal computer for work.
A2.9List every cloud service your organisation uses.
What the assessor is looking for: All of them — cloud services cannot be left out of scope. That means anything you sign in to over the internet that stores or processes your business’s data, and the question set says social media accounts count too. The list you give here is the list the MFA questions (A7.14–A7.17) are then judged against.
Example answer (illustrative — replace with your own):
Microsoft 365 Business Standard (email, Teams, OneDrive, SharePoint); Xero (accounts); Dropbox Business (client file exchange); our LinkedIn company page and Facebook business page.
A4 — Firewalls
A4.2.1Describe how the admin password on your router or firewall gets changed.
What the assessor is looking for: That somebody in the business actually knows how to do it. A short description of who does it and how is enough. Home routers your business didn’t supply aren’t covered by this question.
Example answer (illustrative — replace with your own):
The owner signs in to the router’s admin page from a laptop on the office network, using the admin account, and sets a new password under the administration settings. The password is at least 12 characters, unique to the router, and kept in the owner’s password manager.
A4.6Have you reviewed your firewall rules in the last 12 months? Describe the review.
What the assessor is looking for: A real review with a date: who looked, what they checked, and that anything no longer needed is removed. The guidance asks when services are reviewed, who decides to remove them, and who checks it has been done.
Example answer (illustrative — replace with your own):
Yes. The owner reviewed the router’s settings in September 2026 and confirmed there are no port-forwarding or other inbound rules. We repeat this every September before renewal, and whenever the router is replaced. If a rule is ever found that is no longer needed, the owner removes it the same day and notes it in our IT log.
A4.8Describe how you approve and document any inbound connections you allow.
What the assessor is looking for: Any rule that lets the internet reach something inside your network needs a written business reason, approval by an authorised person — the guidance says the business case is signed off at board level — and regular review. If you allow none, say so plainly and say what would happen if you ever needed one.
Example answer (illustrative — replace with your own):
We do not allow any inbound connections; the router blocks them by default and no ports have been opened. If we ever needed one, the owner would approve it in writing, record the business reason and the date in our IT log, and review it at the yearly firewall check.
A5 — Secure configuration
A5.1Have you removed or switched off software and services you don’t use? Describe how.
What the assessor is looking for: That it happens on every kind of device and on your cloud services too, and that it is done regularly rather than once. Say who does it and when.
Example answer (illustrative — replace with your own):
Yes. When a laptop is set up, the office manager removes the trial software and apps we don’t use before it is handed over. Every six months she goes through the installed apps on each laptop and phone and removes anything no longer needed. In Microsoft 365 we have switched off the services we don’t use.
A6 — Security update management
A6.4.2Where automatic updates aren’t used, how do you make sure high-risk and critical updates to operating systems and router firmware go on within 14 days?
What the assessor is looking for: If you only use automatic updates, the question set asks you to confirm that in the notes — so say so. If anything is updated by hand, describe who checks, how often, and how the 14-day limit is met every time. Missing the 14 days is an automatic fail at A6.4.
Example answer (illustrative — replace with your own):
We only use automatic updates. Windows Update is switched on on every laptop and our phones update automatically. The router is set to install firmware updates automatically; the office manager signs in on the first Monday of each month to confirm it is on the latest version.
A6.7If you need to keep using unsupported software, have you moved it out of scope? Explain how.
What the assessor is looking for: Unsupported software either comes off the device or goes on a separate part of the network, walled off by a firewall or VLAN, with no internet access. Where you use no unsupported software at all, the question set asks you to declare that here.
Example answer (illustrative — replace with your own):
We do not use any unsupported software anywhere in the organisation. All operating systems and applications are versions their makers still update, so nothing has been moved out of scope.
A7 — User access control
A7.1Are user accounts only created after an approval process? Describe it.
What the assessor is looking for: That accounts are approved by someone with a leadership role before they exist, and that there is a recognisable process — who approves, who creates, what the new person gets.
Example answer (illustrative — replace with your own):
Yes. When someone joins, the owner approves the accounts they need by email to the office manager, who creates their Microsoft 365 account and their own login on their laptop. Access to Xero is added only if the owner’s email says the role needs it.
A7.3How do you make sure leavers’ accounts are deleted or disabled?
What the assessor is looking for: That someone who leaves can no longer get in to any of your systems, and that this is a routine rather than something you remember to do. Say who does it, when, and which accounts.
Example answer (illustrative — replace with your own):
On a leaver’s last day the office manager blocks sign-in on their Microsoft 365 account, removes them from Xero and Dropbox, and disables their laptop login. She works from our list of services so none is missed, and the owner confirms by email that it has been done.
A7.4Do staff have only the access they need for their current job? How do you make sure?
What the assessor is looking for: Least privilege: people can reach the files, folders and applications their role needs, and no more — and access is changed when someone changes role.
Example answer (illustrative — replace with your own):
Yes. Access is given by role: only the owner and the bookkeeper can use Xero, and client folders in SharePoint are shared only with the people working on that client. When someone changes role the owner tells the office manager what to add and what to remove, and she updates it that week.
A7.6How do you make sure separate accounts are used for administrative tasks?
What the assessor is looking for: A separate administrator account for admin work — installing software, changing settings — on devices and on cloud services alike. Everyday work happens in a standard account. The question set says cloud service administration must be carried out using separate accounts.
Example answer (illustrative — replace with your own):
Everyone’s day-to-day laptop login is a standard user account. Each laptop has a separate administrator account that only the office manager knows the password to, used when software needs installing. In Microsoft 365 the owner and the office manager each have a separate named admin account, apart from their everyday accounts.
A7.7How do you stop administrator accounts being used for everyday things like email and browsing?
What the assessor is looking for: That admin accounts aren’t used to read email or browse the web. The guidance says this doesn’t need a technical solution — it can rest on good policy, procedure and regular training.
Example answer (illustrative — replace with your own):
Our Microsoft 365 admin accounts have no mailbox and are used only in the admin centre. The laptop administrator accounts are used only to approve an installation, never to sign in for normal work. Our user access policy says admin accounts are not for email or browsing, and the two people who hold them are reminded each year.
A7.10How are your password-protected systems protected against someone guessing passwords over and over?
What the assessor is looking for: At least one of three protections on each system: multi-factor authentication; throttling, so that no more than 10 guesses are possible in 5 minutes; or locking after no more than 10 failed attempts.
Example answer (illustrative — replace with your own):
All our cloud services have multi-factor authentication switched on for every user and administrator. Our Windows laptops are set to lock the account after 10 failed sign-in attempts. Our phones use the maker’s built-in limits on wrong passcode attempts.
A7.12Explain how you encourage people to use strong, unique passwords.
What the assessor is looking for: That people are told how to choose a good password and given somewhere safe to keep it. The requirements name the approach: avoid common or reused passwords, use three random words or more, provide secure storage such as a password manager, and don’t force regular changes or complexity rules.
Example answer (illustrative — replace with your own):
New starters read our one-page password policy on their first day. It asks for a different password for every work account, made of three or more random words, and never one used elsewhere. We provide a password manager for everyone. We don’t make people change passwords on a schedule or add symbols — only when a password may have been compromised.
The questions an example can’t help with
Some questions have no wording to get right, only a fact. Whether every operating system is still supported (A6.1), whether high-risk and critical updates always go on within 14 days (A6.4, A6.5), and whether multi-factor authentication is switched on for every administrator (A7.16) and every user (A7.17) of your cloud services are yes-or-no questions. A “no” to the MFA questions fails the assessment, and so does listing a cloud service as having no MFA option when it has one (A7.15). One cloud account without MFA is not a small gap to explain in the notes. The MFA guide and the 14-day update guide cover what has to be true.
What makes a good free-text answer
- Say who. “The office manager” or “the owner”, not “the business”.
- Say when or how often. “On their last day”, “every September”, “when a laptop is set up”.
- Say what actually happens. Two or three plain sentences describing the routine beat a paragraph of policy language.
- Keep it consistent. The devices and cloud services you list in the scope section are the ones your later answers are read against. The scope guide and the asset register template help you get that list right first.
- Answer the “if none” case. Where you have nothing to describe — no inbound firewall rules, no unsupported software, nothing updated by hand — say so plainly rather than leaving the box thin.
For every question rather than these 15, the question-by-question guide explains each core question in plain English and what has to be true, and the self-assessment guide explains how the answers are marked. Several of the user-access answers above are easier to give if the process is written down: the user access policy template and the password policy generator are free.
Frequently asked questions
Are there official example answers for Cyber Essentials?
The official question set prints guidance under each question, and a few short examples of format — such as how to list your laptops — but not model answers to the descriptive questions. The examples on this page are ReadyCert’s own, written for a made-up business from that guidance. They are preparation guidance, not official wording.
Can I copy example answers into the Cyber Essentials questionnaire?
No. Your answers have to describe your own business as it is today, and a board-level representative, the owner or an equivalent must approve them. Use an example to see what a good answer covers — who does it, when, and what actually happens — then write your own.
How long should a Cyber Essentials answer be?
The question set doesn’t set a length. Two or three plain sentences that say who does the thing, when or how often, and what actually happens are usually enough for the assessor to judge it against the requirements.
What do I write if a question doesn’t apply to me?
Say so plainly. The question set asks for this in places: where you only use automatic updates, confirm that in the notes for A6.4.2; where you use no unsupported software, declare that at A6.7. “We don’t allow any inbound connections” is a complete answer if it is true.
Which Cyber Essentials answers can’t be fixed with better wording?
The automatic fails. An unsupported operating system (A6.1), high-risk or critical updates not installed within 14 days (A6.4, A6.5), a cloud service wrongly listed as having no MFA (A7.15), or MFA not applied to every administrator (A7.16) and every user (A7.17) of your cloud services each fail the assessment whatever the notes say.