Cyber Essentials controls explained: what matters and what evidence to gather

Where the effort should go first

The NCSC describes Cyber Essentials as built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. All five count. But the current requirements (v3.3, effective from 27 April 2026 according to the NCSC resources page) do not treat them equally when marking.

IASME, which runs the scheme with the NCSC, says stricter marking now applies to some critical practices, and that failing them is an automatic failure of the assessment. Two areas are named. One is MFA, which is mandatory on cloud services wherever it is available, including where it is free, bundled or only sold as a paid extra. The other is patching: questions A6.4 and A6.5 cover installing high-risk or critical updates within 14 days of release, for operating systems and router or firewall firmware (A6.4) and for applications (A6.5).

Our view, as engineers rather than assessors: those are the places a small business is most likely to be caught out, because they depend on habits rather than a one-off setup. A firewall is configured once. Patching and MFA enrolment drift every week, and a cloud service nobody remembers signing up for can sink an otherwise tidy submission.

Get the scope right before the controls

Scope is the list of devices, networks and services your certificate will cover, and you describe it in your application. v3.3 tightens it in ways that matter to small firms. IASME says cloud services cannot be excluded from scope, and defines a cloud service as an on-demand, scalable service on shared infrastructure, reached through an account, that stores or processes your organisation's data. The words 'untrusted' and 'user-initiated' have also been removed from the wording about internet connections, and anything you leave out must be described, with a justification you can defend.

Consider a 15-person design studio. Its scope is not just the laptops. It includes the Microsoft 365 or Google Workspace tenant, the accounting package, the file-sharing service the freelancer set up in 2022, the office router and any phones that read company email. Written down as a simple inventory, that list becomes the spine of your evidence: every item either has proof against each control or a reason it is out.

• Devices: laptops, desktops, phones and tablets that access business data, and who uses each.
• Network equipment: the router or firewall at each site, and any servers.
• Cloud services: every service holding or processing your data, including the free ones and any that are used by only one or two people.
• Exclusions: anything left out, with a plain explanation of why it is genuinely separate. Do not exclude something just because it is awkward.

The five controls: what you are proving and what shows it

The NCSC requirements document governs the exact control wording. The points below are a plain-English overview, not a quotation or substitute for the published requirements. Check each against the current NCSC requirements and the IASME question set before you answer. The evidence suggestions are our own recommendations, not a list prescribed by the scheme.

• Firewalls: you are showing that the boundary between your network and the internet is deliberately controlled, and that the device doing it is not left on factory settings. Useful evidence is a dated screenshot or configuration export showing the model, firmware version and the rules or default-block behaviour, plus confirmation that its admin interface is not open to the whole internet.
• Secure configuration: you are showing that devices and accounts are not left in their out-of-the-box state. Useful evidence is a list of devices with the operating system and a note of which unused accounts and software have been removed, plus the sign-in or lock settings applied.
• Security update management: you are showing that supported software is kept up to date quickly. Useful evidence is an update or patch-status report from your management tool or each operating system, with dates, plus a list of any software that no longer receives security updates and what is being done about it. Remember the 14-day expectation for critical and high-risk updates.
• User access control: you are showing that people only have the access they need, that administrator rights are not used for everyday work, and that MFA protects cloud services. Useful evidence is the list of administrator accounts, the MFA status per user for each cloud service, and the setting that enforces it rather than merely allowing it.
• Malware protection: you are showing that each in-scope device has a protection mechanism that is switched on and working. Useful evidence is a console report or dated screenshot per device type showing the product, its status and last update.

The MFA trap

MFA is where we would expect the most avoidable failures. An independent consultancy write-up of the v3.3 MFA rules, which links back to the NCSC document, makes the point that the rule covers user accounts and not only administrators, and that MFA people are merely able to enrol in does not help if it is not enforced. Enabling it for the owner and the IT manager while 12 staff sign in with a password alone is not a pass.

Passwordless sign-in such as passkeys using FIDO2 is highlighted in the user access control section as a route to meeting the requirement, but the same write-up cautions that the implementation should be verified rather than assumed. Where a password is part of the MFA, that write-up gives a minimum of eight characters with no maximum length limit. Check this specific password-length requirement against the current NCSC and IASME assessment wording before relying on it.

What credible evidence looks like

Be careful about assuming what is uploaded. Basic Cyber Essentials is described by the NCSC as a combination of self-assessment and independent audit, and IASME mentions a signed declaration covering the self-assessment. Evidence submission requirements should be checked with the certification body for Basic, while Cyber Essentials Plus adds independent technical testing to verify the controls in practice. The sensible approach is to gather evidence anyway. If you cannot show your answers, you do not really know them.

Good evidence shares a few habits. It is dated. It shows a setting rather than an intention, so a screenshot of an enforced policy beats a sentence in a policy document. It can be traced to an item in your inventory. And it contains no secrets: blank out passwords, recovery codes, API keys and personal data before you save or share it, and keep the folder somewhere access-controlled rather than in an open shared drive.

• Prefer exports and built-in reports to hand-typed spreadsheets, because they are harder to get subtly wrong.
• Record who captured each item and on what date, so staleness is obvious.
• Keep a short note against anything you answered 'unsure', so it is resolved before you submit, not guessed.
• If a control is met by a supplier's service rather than your own settings, keep a record of what the supplier does and where you have verified it.

A safe order for assessing yourself

Assessment itself should be read-only. The risk comes when you start fixing things, because enforcing MFA, rebooting for updates or tightening a firewall can interrupt the people you are trying to protect. The sequence below keeps the looking separate from the changing. It needs someone with administrator access to your cloud services, devices and router, and should be done by that person or a trusted IT provider rather than by delegating admin rights casually.

1. Write the scope inventory described above, including cloud services and any exclusions with reasons. Ask each team about services they use; the finance and marketing tools are the usual ones that go missing from IT's list.
2. Review each control read-only: open the relevant admin portals, reports and device settings and record what is true today as yes, no or unsure, with a dated screenshot or export. Do not change anything in this pass.
3. Rank the gaps. Anything touching MFA on a cloud service, the 14-day update expectation or software that no longer receives security updates goes first, because IASME says the MFA and patching failures are automatic.
4. Fix one thing at a time, starting with a small pilot group. Before enforcing MFA, make sure at least two administrators have a working second factor and a documented emergency route in, so a mistake does not lock everyone out. Expect users to be prompted at next sign-in and some older mail or sync apps to stop working until updated. To roll back, you need the ability to switch the enforcement off again, so note where that setting lives before you begin.
5. Treat patching with similar care: update a test machine or a small group first, because restarts interrupt people and an update can occasionally upset a line-of-business application. Software that no longer gets security updates cannot be patched into compliance, so it needs replacing or a different plan, which is worth discussing with your assessor or provider early.
6. Re-check each fixed item and capture fresh dated evidence. Success is that every in-scope item has proof against every control, or a reasoned exclusion, and nothing remains marked unsure.
7. Have someone with authority read the final answers before submission. The declaration is signed on behalf of the organisation, and it is not a place for guesses.

Cost, timing and the insurance question

The NCSC overview page currently gives Cyber Essentials as starting at £320 plus VAT, tiered by organisation size, with Plus priced according to the size and complexity of your network. It also says UK organisations with turnover under £20m that certify their whole organisation are automatically entitled to cyber liability insurance arranged through IASME, including 24/7 incident response support. These figures were taken from the page in November 2026 and can change, so confirm them with your certification body before quoting them to anyone.

On timing, IASME's articles say v3.3 applies to assessment accounts created after late April 2026, and that earlier accounts can complete on the previous version, but IASME's own pages give both 26 and 27 April, and a secondary source gives a different end date for the transition. The NCSC resources page says 27 April 2026. If you opened an assessment account before then, do not rely on our summary: ask your certification body which version and deadline apply to you.

When to hand it over

A small firm with a handful of laptops and one cloud suite can often do this internally, provided someone competent checks the work. Bring in help when you have servers, several sites, no clear list of cloud services, software that has reached end of life, or anyone nervous about changing MFA or firewall settings on a live system. The cost of a careful second opinion is small next to a failed submission or a lock-out on Monday morning.