The Cyber Essentials questionnaire, question by question, in plain English
The 42 core technical questions in the 2026 self-assessment (IASME’s “Danzell” set, aligned to NCSC v3.3), rewritten in the words a business owner would use, with the official question number beside it and what actually has to be true. Not example answers to copy — an honest map of what you are being asked.
The questionnaire at a glance
- It is IASME’s 2026 “Danzell” question set (the booklet is marked version 16.3, May 2026), aligned to the NCSC’s Requirements for IT Infrastructure v3.3 — around a hundred questions in all, counting follow-ups.
- Sections A4 to A8 decide the result: firewalls, secure configuration, security update management, user access control and malware protection. Sections A1 to A3 cover your organisation, your scope and optional insurance.
- Six answers fail the assessment on their own: unsupported operating systems (A6.1); high-risk, critical or unrated security updates not installed within 14 days (A6.4, A6.5); and MFA not on for every user and admin of your cloud services, or a cloud service listed as unable to do MFA when it can (A7.15 to A7.17).
- Answers describe today. “We are about to switch MFA on” is a no — submit when it is true.
- An assessor reads what you write and judges it against the NCSC requirements, so free-text answers should say what actually happens, who does it and how often.
How the questionnaire is built
The official self-assessment has three parts. The first (sections A1 and A3) covers your organisation — name, size, sector, whether this is a first application or a renewal, and a declaration that you have read the requirements — and the optional cyber insurance. The second (section A2) is scope: what locations, devices, routers and cloud services the certificate covers, and who looks after IT — see the scope guide. The third, and the part that decides the result, is the five technical controls: sections A4 to A8. This guide covers 42 core questions from those sections; most follow-up sub-questions are folded into the notes.
Answers are typed — yes/no, a choice from a list, and free text. You don’t normally upload anything at this level, but your certification body can ask for evidence before certifying; an assessor reads what you wrote and judges it against the NCSC requirements. That is why the free-text parts matter — a bare “yes” tells the assessor nothing about whether you understood the question. Every technical question below traces back to the five controls behind these questions.
Before you look at the questions
- The automatic fails. 6 questions below are marked Auto-fail. A wrong answer to any of them — usually a “no” — fails the assessment on its own. Clear those first: the free two-minute check covers five of them, with no account.
- Answers describe today. “We are about to switch MFA on” is a no. Submit when it is true.
- The wording here is ours. The official questions belong to IASME and are linked under Sources. Use this page to understand them, then answer the official ones in the portal.
A4 — Firewalls
Something must sit between your devices and the internet, and its settings must not be the factory defaults.
A4.1 Is there a firewall sitting between your office network and the internet — usually the router your internet provider gave you, or a dedicated firewall box?
What has to be true: Yes. For most small offices the broadband router is the firewall.
A4.1.1 Is the built-in firewall switched on on each of your computers and laptops — the one that comes with Windows or macOS?
What has to be true: Yes, on every machine. Windows Firewall is on by default; the macOS firewall is off by default and has to be switched on.
A4.2 The admin password for your router or firewall — the one used to change its settings, not your Wi-Fi password — have you changed it from whatever it came with?
What has to be true: Yes. A default password, even a unique-looking one on a sticker, is a gap until it is changed.
A4.3 How is the admin password for your router/firewall kept strong?
What has to be true: It meets one of the three password rules: MFA, at least 12 characters, or at least 8 characters with common passwords blocked.
A4.4 If you found out your router or firewall password might have been exposed — say the maker warned of a security flaw — would you know how to change it quickly?
What has to be true: Yes — you know where the setting is and who does it.
A4.5 Do you have a way of deciding — with a clear reason — before opening up your network to let something be reached from the internet (like a VPN or a server)?
What has to be true: Yes. Any inbound rule is approved, written down with a business reason, and removed when no longer needed.
A4.6 Have you looked over your firewall’s rules in the past year and removed anything you no longer need?
What has to be true: Yes, within the last 12 months. For most small offices there is nothing to remove.
A4.7 Can anyone reach devices on your network from the internet without logging in first? (Most routers block this by default — but it’s worth checking.)Needs a look
What has to be true: No. If something on your network is reachable from outside, it needs a careful look — this is one to get help with.
A4.9 Can your router or firewall’s settings be changed over the internet — for example, so your IT support can log in remotely? (If it’s only reachable in the office or over a VPN, answer no.)Needs a look
What has to be true: No — or yes, with a written business reason, and protected by MFA or by an allow-list of trusted addresses plus a properly managed password.
A5 — Secure configuration
Devices and services only do what you need them to, with nothing left on its defaults.
A5.1 Have you removed or switched off apps and features you don’t actually use on your computers, phones and online tools — the stuff that came pre-installed or got added and never touched?
What has to be true: Yes. Unused software is a way in; uninstall it.
A5.2 On your devices and online tools, are the only logins the ones your team actually uses — with no leftover guest accounts or old accounts lying around?
What has to be true: Yes. Old and guest accounts are removed or disabled.
A5.3 Have you changed any default or easy-to-guess passwords on your devices, and do your passwords meet one strong-password rule — two-factor login, at least 12 characters, or at least 8 characters with common passwords blocked?
What has to be true: Yes to both halves.
A5.8 When you plug in a USB stick or download a file, are your computers set to NOT run it automatically — either blocking it, or asking you first?
What has to be true: Yes. Auto-run and auto-play are off, or the computer asks first.
A5.9 Do your computers, phones and tablets need a fingerprint, face, password or PIN to unlock before anyone can use them?
What has to be true: Yes, on every device. A PIN or password of at least 6 characters is fine if it only unlocks the device; if it also signs in to work data, the full password rules apply.
A6 — Security update management
Everything still supported by its maker, and high-risk, critical or unrated security updates installed within 14 days. Three of these are automatic fails.
A6.1 Are all your devices running an operating system that still gets security updates from its maker — nothing so old it’s been retired? (This includes your router’s built-in software.)Auto-fail
What has to be true: Yes, every one. An unsupported operating system anywhere in scope fails the assessment.
A6.2 Is all the other software you use — browsers, email, office apps, security software — still getting updates from whoever makes it?
What has to be true: Yes. You will be asked to list your browsers, anti-malware, email and office apps.
A6.3 Is any of your software or online tools unlicensed, or on a plan that doesn’t get security updates?
What has to be true: No.
A6.4 When a high-risk or critical security update — or a security update whose severity the maker doesn’t say — comes out for your devices’ operating systems or your router, does it always get installed within 14 days?Auto-fail
What has to be true: Yes, every time. A no here is an automatic fail.
A6.4.1 Are automatic updates switched on for your devices’ operating systems?
What has to be true: Yes. Automatic updates must be on wherever a device allows it; a manual process (A6.4.2) is only for devices that can’t auto-update, and still has to meet the 14 days — monthly usually does not.
A6.5 When a high-risk or critical security update — or a security update whose severity the maker doesn’t say — comes out for your apps (browsers, office software and the like), does it always get installed within 14 days?Auto-fail
What has to be true: Yes, every time. A no here is an automatic fail.
A6.6 Have you removed any software that’s no longer supported — old browsers, old operating systems, retired apps?
What has to be true: Yes, or there was none.
A6.7 If you have to keep some unsupported software, have you put it on a separate, walled-off part of your network with no internet access?
What has to be true: Yes, or you have none to keep. Anything unsupported and still connected is a fail.
A7 — User access control
Who can log in, with what, and whether two-factor login is on. The MFA questions at the end are where most businesses fail.
A7.1 When someone new needs a login — to a laptop, a server, or an online tool — is there a set way you decide to give it to them, with sign-off from an owner or manager?
What has to be true: Yes — a joiner process, even a short written one.
A7.2 Does everyone on your team have their own login, or do some people share an account?
What has to be true: Everyone has their own. Shared logins are a gap.
A7.3 When someone leaves the business, how quickly is their access to your systems and tools switched off?
What has to be true: Promptly, through a leaver process you could describe.
A7.4 Do people only have access to the files, folders and apps they actually need for their job — rather than everyone being able to get into everything?
What has to be true: Yes.
A7.5 Before you give someone admin rights (the power to install software or change settings), is there a set way you decide and approve it?
What has to be true: Yes.
A7.6 When someone needs to do admin work — like installing software or changing settings — do they switch to a separate admin account, rather than using their normal everyday account?
What has to be true: Yes. Everyday accounts should not have admin rights.
A7.7 When someone is signed in with their admin account, do they avoid using it for everyday things like browsing the web or checking email?
What has to be true: Yes.
A7.8 Do you keep a record of who has admin rights across your systems?
What has to be true: Yes — a simple list is enough.
A7.9 Do you check your list of admin users every so often — say monthly, quarterly or yearly — and remove admin rights from anyone who no longer needs them?
What has to be true: Yes, on a regular cycle.
A7.10 How are your logins protected when someone keeps guessing a password?
What has to be true: By MFA, by throttling repeated attempts (no more than 10 guesses in 5 minutes), or by locking the account after no more than 10 wrong tries.
A7.11 How do you keep work passwords strong?
What has to be true: With one of: MFA; a minimum of 12 characters; or a minimum of 8 characters plus automatic blocking of common passwords. There is no 14-character rule.
A7.12 Do you give your team some help on picking good passwords — like suggesting three random words, or offering a password manager?
What has to be true: Yes. No forced expiry, no complexity rules — those are discouraged.
A7.13 If you thought a password had been stolen or an account hacked, do you have a clear way to react quickly and change it?
What has to be true: Yes.
A7.14 Do all the online tools you use offer two-factor login (a code or prompt as well as a password) as an option?
What has to be true: Yes, if every one offers it — almost all do. Any that truly don’t go in A7.15.
A7.15 Which of your cloud services genuinely have no MFA option at all? (This is where you list them.)Auto-fail
What has to be true: Only services that truly cannot do MFA. Listing one that can is an automatic fail.
A7.16 For the people who manage your online tools (the admins), is two-factor login switched on for every one of them?Auto-fail
What has to be true: Yes, every admin on every service. A no here fails the section.
A7.17 And for everyone else who logs into your online tools, is two-factor login switched on for every one of them too?Auto-fail
What has to be true: Yes, every user on every service. A no here fails the section.
A8 — Malware protection
Each device needs anti-malware software, or a rule that only approved apps can run.
A8.1 How are your devices protected from viruses and malware?
What has to be true: Anti-malware software is installed (Windows Defender counts), and/or application allow-listing: apps restricted to signed or app-store apps AND to a list of approved apps your business keeps (personal devices included). At least one per device; anti-malware is an option only for Windows and macOS.
A8.3 Does your anti-virus or web browser warn you — or block you — before you land on a known dangerous website?
What has to be true: Yes.
A8.4 On the devices where you rely on an app store or approved apps, are people stopped from installing unofficial or unsigned apps — i.e. the device isn’t ‘jailbroken’ or ‘rooted’?
What has to be true: Yes.
Writing the free-text answers
Where a question asks you to describe something — your joiner process, how updates are applied, what anti-malware you use — write two or three plain sentences that say what actually happens, who does it, and how often. “New starters get accounts set up by the office manager after the owner approves the hire; leavers’ accounts are disabled the same day by the same person” is a better answer than a paragraph of policy language. If you have a short written policy, say so and summarise it. The password policy generator produces one of those documents for free.
Frequently asked questions
How many questions are in the Cyber Essentials questionnaire?
The 2026 question set has around a hundred questions in total, many of them about your organisation and scope. The five technical controls sit in sections A4 to A8; this guide covers 42 core questions from those sections, with most follow-up sub-questions folded into the notes.
Are there example answers for the Cyber Essentials questionnaire?
Copying example answers is a bad idea: the assessor is judging whether your description matches your actual setup. This guide explains what each question means and what has to be true, so you can answer truthfully in your own words.
Which Cyber Essentials questions are automatic fails?
Unsupported operating systems (A6.1); high-risk, critical or unrated security updates not installed within 14 days for operating systems (A6.4) or applications (A6.5); listing a cloud service as unable to do MFA when it can (A7.15); and MFA not on for every admin (A7.16) or every user (A7.17) of your cloud services.
Where is the official question set?
IASME publishes a preview of the self-assessment questions on its website, linked under Sources on this page. The wording on this page is ReadyCert’s plain-English version, not the official text.
Do I have to answer every question?
Yes. Some questions only apply in certain situations (for example, if you have servers), and the portal guides you through those. Answer what is true today, not what you plan to do.