The Cyber Essentials question set for 2026 (Danzell): what’s in it and where to get it

What the question set is

Cyber Essentials is assessed by questionnaire. The NCSC writes the rules, in a document called Requirements for IT Infrastructure (currently v3.3). IASME, which runs the scheme for the NCSC, turns those rules into the questions you answer. IASME gives each version of the question set a name and each version of the requirements a number. The current pairing is the Danzell question set with requirements v3.3; the booklet itself is marked version 16.3, May 2026.

Danzell replaced Willow on 27 April 2026

IASME’s question-preview page offers two versions and tells you which to read by when you bought your assessment: Willow if you purchased before 27 April 2026, Danzell if you are preparing to purchase from 27 April 2026. Anyone starting or renewing now is on Danzell. The same page links IASME’s own comparison of the two sets, and the 2026 changes guide explains what is different in plain English.

Where to download the official question set

From IASME’s page “Preview the Self-Assessment questions for Cyber Essentials”, linked under Sources below. It offers the Danzell question set as a PDF and as an Excel spreadsheet, next to the requirements document. You can download them before you pay: IASME’s suggestion is to download the questions, prepare your answers in the spreadsheet, and paste them into the assessment portal once you have paid for access.

Get it from IASME rather than from a copy someone else has uploaded. The booklet carries a version number (16.3 when we read it), and an old copy could have you preparing for questions that have since changed.

The eight sections, A1 to A8

Every question has a number that starts with its section: A4.2 is the second question in the firewall section, and A4.2.1 is a follow-up to it. The table gives both counts for each section.

How we counted. We listed every distinct question number printed in the Danzell booklet (version 16.3, May 2026). “Questions” counts numbers with two parts, such as A6.4. “With follow-ups” adds the three-part numbers printed beneath them, such as A6.4.1 and A6.4.2. That gives 79 and 106. If you see a different total elsewhere, check which version was counted and whether follow-ups were included.

The five technical controls are sections A4 to A8: firewalls, secure configuration, security update management, user access control and malware protection. Sections A1 to A3 are about your organisation, what the certificate will cover, and the optional insurance. The requirements guide goes through the rules behind each control.

You won’t be asked all 106

Many follow-ups only apply to some businesses. The partial-scope questions (A2.2 to A2.2.2) are for organisations certifying only part of themselves. A4.10 and A4.11 apply only if your firewall’s settings can be reached from the internet. A7.15 applies only if one of your cloud services offers no multi-factor authentication at all. In the malware section, which follow-ups you answer depends on the option you choose in A8.1. The booklet says you must answer all the questions to achieve certification; the conditional ones are answered where they apply to you.

What kind of answers it asks for

Three kinds: yes or no, a choice from a short list, and free-text notes where you describe how something is done. You prepare with the booklet, but the answers must be entered through IASME’s online assessment platform, and they must be approved by a board-level representative, the business owner or an equivalent before a certificate can be awarded. The self-assessment guide walks through the process from the inside.

The questions that fail the assessment on their own

The booklet marks a small number of questions where one wrong answer is enough. An unsupported operating system on any in-scope device means certification will not be awarded (A6.1). A “no” to installing high-risk and critical updates within 14 days is an automatic fail, for operating systems and firmware (A6.4) and for applications (A6.5). Listing a cloud service as having no MFA option when it does have one is an automatic fail (A7.15). And the assessment fails if multi-factor authentication is not applied to every administrator (A7.16) and every user (A7.17) of your cloud services. Check those before anything else: the MFA guide, the 14-day update guide and the supported operating systems guide cover each one.

How to use it to prepare

1. Download the Danzell set from IASME and skim all eight sections once, so nothing in the portal is a surprise.
2. Build your scope list first (section A2): devices with their operating system versions, routers, cloud services. Later answers are read against it. The scope guide explains what is in and out.
3. Check the automatic fails and fix anything that isn’t true yet.
4. Work through A4 to A8. The question-by-question guide puts the core questions in plain English, and the interactive checklist tracks where you are.
5. Draft the free-text answers in your own words. The example answers guide shows what a good one looks like for the questions people find hardest.