The Cyber Essentials self-assessment: a walkthrough for people who’ve never done one

What “self-assessment” means here

Cyber Essentials at the basic level is a questionnaire you complete yourself, about your own business, reviewed by an assessor at the IASME-licensed certification body you bought it from. Nobody visits and nothing is installed. You don’t normally upload evidence — your written answers are the assessment — though your certification body can ask for evidence before certifying. That makes it accessible — a ten-person business with no IT department can do it — and it makes the quality of your answers the whole game. The assessor is checking two things: whether what you describe meets the NCSC requirements, and whether you understood the question well enough to describe it properly.

What it looks like from the inside

You get a login to an online portal from your certification body. The questionnaire is split into sections, each a list of questions with a yes/no or multiple-choice part and usually a free-text box. You can save and come back. The current question set is IASME’s “Danzell”, aligned to version 3.3 of the NCSC requirements and in force from April 2026; each year’s set has a name and the questions shift a little. A declaration at the end confirms that a senior person in the business stands behind the answers.

Part one: your organisation (A1 and A3)

Legal name, type of organisation, number of employees, registration number, addresses, sector, website, whether this is a first application or a renewal, why you are applying, and a confirmation you have read the requirements document. Ten minutes with your company details to hand.

Part two: scope (A2)

Whole organisation or part; where people work from; how many work from home and how they connect; every router and firewall with make and model; every laptop and desktop with its exact operating-system version; any servers; every phone and tablet used for work, including personal ones; every cloud service, including business social-media accounts; and who is responsible for IT. This is the part to prepare in advance, because the answers are a list you have to go and build. The scope guide has the rules and examples; the asset register template is the list.

Part three: the five controls (A4 to A8)

Firewalls, secure configuration, security update management, user access control and malware protection — the questions that are actually scored. The question-by-question guide goes through every one in plain English with what has to be true for each.

How it is marked

Most questions are gaps if you answer no: the assessor will tell you what needs to change and you fix it. A small number are automatic fails — a no fails the whole assessment regardless of everything else. In the 2026 set those are: any device on an unsupported operating system (A6.1); high-risk, critical or unrated security updates not installed within 14 days for operating systems (A6.4) or applications (A6.5); listing a cloud service as unable to do MFA when it can (A7.15); and MFA not switched on for every admin (A7.16) or every user (A7.17) of your cloud services. The MFA ones are the easiest to get wrong without noticing.

Where people get stuck

• The language. “In-scope end-user devices”, “boundary firewall”, “multi-factor authentication on cloud services” — clear to an assessor, opaque to a plumber. Most bad answers are not dishonest; they are guesses at what the question meant.
• Scope surprises. Personal phones with work email, the business Facebook page, the home-office router. Each is either in or out by a rule, and the rule is not obvious.
• “Mostly.” MFA is on for most people. Updates are mostly automatic. The questionnaire does not have a “mostly” option; it has yes and no, and the assessor reads your free text.
• Old kit. The spare laptop on Windows 10 with no Extended Security Updates enrolment, the phone that stopped getting updates two years ago. Unsupported means fail, and there is no toggle to fix it.
• Submitting too early. Paying the fee before checking the automatic fails is an easy way to waste money on Cyber Essentials.

How to prepare so the portal is the easy part

1. Build the scope list first. Devices with OS versions, routers with models, cloud services. An hour, and it answers most of the scope section.
2. Run through the five controls honestly with the checklist or the readiness check. Write down every no.
3. Clear the automatic fails, then the rest. Most are ten-minute settings; unsupported devices are the exception and need a decision.
4. Write the short policies so your free-text answers have something to point at: passwords, joiners and leavers, admin accounts, updates, malware, firewall.
5. Draft your answers before you log in. A document with every question and your answer means the portal session is copying, not thinking.
6. Buy the assessment and submit. Pick a certification body, pay the fee for your size, transfer the answers, sign the declaration.

Time, realistically

The portal itself: an afternoon. The preparation: for a tidy business with modern laptops and Microsoft 365 or Google Workspace, a few hours spread over a week or two; for one with shared logins, no written processes and a couple of old machines, longer — because the fixes are real work, not paperwork. The cost guide separates the fee from the time.