The Cyber Essentials checklist, 2026 edition

What this checklist is

Cyber Essentials is assessed with a self-assessment questionnaire — the 2026 version is called “Danzell”, aligned to NCSC v3.3 — rather than a checklist. The questions are written for assessors and group into five technical controls plus a scope section. This page turns those questions into 50 plain-English items you can actually tick, grouped the same way the questionnaire is, so when you sit down with the official form nothing is a surprise.

Each item shows the official question reference (for example A7.16) so you, or an assessor, can check it against the IASME question set and the NCSC requirements document linked under Sources at the bottom of the page. Where a “no” fails the assessment outright — there are 6 of those — the item is marked auto-fail. Those are the ones to look at first.

How to use it

1. Start with scope. Write down every device and cloud service that touches work data before you judge anything else. Most surprises in Cyber Essentials are things people forgot were in scope: a personal phone with work email on it, a business LinkedIn account, the router in a home office.
2. Tick only what is true today. “We're going to switch MFA on next week” is a gap, not a tick. The point of the checklist is to find gaps while they are cheap to fix.
3. Clear the auto-fail items first. Unsupported operating systems, high-risk or unrated security updates that take longer than 14 days, and any cloud account without MFA each fail the assessment on their own, however good everything else is.
4. Save it. Ticks stay in your browser. Use “Print / Save as PDF” for a copy to share, or “Download CSV” for a spreadsheet you can hand to whoever looks after your IT. For a clean paper form with a box per line, use the printable checklist PDF.

What the five controls cover

• Firewalls — something sits between your devices and the internet, and its admin password is not the factory default.
• Secure configuration — devices and services only do what you need, with default passwords changed, auto-run off and screens that lock.
• Security update management — everything is still supported by its maker, and important updates land within 14 days.
• User access control — everyone has their own login, admin accounts are kept separate, and MFA is on wherever a cloud service offers it.
• Malware protection — each device runs anti-malware software or only allows approved apps.

For the reasoning behind each control, the plain-English guide to Cyber Essentials walks through them; for the rule that catches most businesses out, read the MFA guide.