All services Every engagement has a fixed, published price. Book a strategy call
How to answer the Cyber Essentials questionnaire, with seven worked example answers reviewed by an IASME licensed certification body: what a weak answer looks like, what a strong one looks like, and why scope decides everything.
If you are working through the Cyber Essentials questionnaire, the most important thing to understand is this:
You are not being judged on how confident your answers sound. You are being judged on whether your answers match reality.
That is where most organisations go wrong.
Cyber Essentials works through a verified self-assessment questionnaire. You answer a set of questions about your users, devices, systems, work locations, and the five technical control areas. IASME lets you preview the self-assessment questions before you buy access to the portal, and the NCSC’s requirements document makes clear that your organisation is responsible for making sure you meet every requirement in scope.
This guide explains:
The Cyber Essentials questionnaire is the core of the standard Cyber Essentials certification process. It is a verified self-assessment rather than a technical audit. You answer questions about your environment, and those answers are reviewed by a Certification Body. Cyber Essentials Plus comes later and is only possible after the verified self-assessment stage is complete.
In practical terms, the questionnaire covers:
It is designed to confirm whether your organisation has the minimum cyber security baseline in place. The scheme itself is government-backed, recommended by the NCSC, and aligned to five technical controls designed to prevent the most common internet-based threats.
If you want a guided route through the assessment, see our Cyber Essentials Certification service.
The questionnaire is not trying to trap you with complex wording. It is trying to test three things:
If you do not know what devices, users, systems, and cloud services are in scope, your answers will be weak from the start. The NCSC requirements document says the first thing you should do is establish the boundary of scope and then determine what is in scope within that boundary.
The questions are built around the five Cyber Essentials themes:
This is the big one.
Many organisations fail because they answer according to policy, habit, or assumption, rather than according to what is true on the devices and systems being assessed.
If you want the wider picture behind the question set, read our guide to Cyber Essentials requirements so you understand what the questionnaire is trying to prove.
This is the simplest way to improve your pass rate.
IASME allows organisations to download and preview the Cyber Essentials self-assessment questions in advance. Use that. It is one of the best preparation tools available because it lets you see the structure before you commit to submission.
Write down:
Do not guess. Confirm it.
Check the actual state of:
The NCSC requirements document is clear that you should review each of the five technical control themes and take the steps needed to ensure your organisation meets every requirement for the scope you have chosen.
If you use an MSP or outsourced IT provider, bring them in early. IASME even publishes a dedicated question list for third-party IT providers to help organisations confirm whether outsourced controls meet the standard. That tells you how common this issue is.
If you want the full process around preparation, submission and review, read our guide on How to pass Cyber Essentials first time.
The exact wording can change with annual scheme updates, and IASME has already confirmed that the next annual update applies to assessment accounts created after 27 April 2026, with a new question set published by early February 2026.
You should also read our Cyber Essentials 2026 guide so you understand the latest scheme changes before you answer the current question set.
However, the overall structure is stable. You can expect questions around:
The assessment has to cover the whole IT infrastructure used to carry out your organisation’s business, or a clearly defined and separately managed subset where that is allowed.
The questionnaire asks how users are managed, how admin rights are controlled, and how access is removed when people leave.
You will need to answer for laptops, desktops, servers, and any other in-scope technology.
Remote working is built into modern Cyber Essentials thinking. The question set expects you to understand how home working, cloud access, and remote access are secured.
Cloud systems such as Microsoft 365 or Google Workspace are in scope if they are accessed via business accounts and store or process organisational data.
The heart of the questionnaire is your implementation of the five technical controls.
If you need the technical side explained properly, read our guide to Cyber Essentials controls and what each of the five controls means in practice.
The best way to answer the questionnaire is to think like an assessor rather than like an optimistic manager.
Do not write or select an answer because it is “mostly true”.
Cyber Essentials is not asking whether you are trying. It is asking whether the control is in place.
If you have 25 laptops and only 18 are well controlled, your answer must reflect the weakest relevant device in scope.
Check live systems, settings, inventories, admin groups, anti-malware dashboards, and patching consoles.
The forgotten laptop, old admin account, or unsupported machine is often what causes delay.
If you say users do not have unnecessary admin rights in one part of the questionnaire, but later reveal that several people keep permanent local admin access, you have created a contradiction.
This is the part most guides will not give you, and we can: Intelance is an IASME licensed certification body, which means our assessors review Cyber Essentials questionnaires for a living. The examples below show the difference between answers that sail through and answers that trigger rejection or a round of follow-up questions.
One warning before you copy anything: copy the style, never the sentences. Your answers must describe your environment, and assessors read enough recycled boilerplate to spot it instantly. An answer that is specific, dated and checkable beats an answer that is polished.
A weak answer: “Our router is managed by our IT company and we believe remote admin is switched off.”
Why it struggles: “We believe” is the phrase assessors underline. It tells them nobody checked. The answer also says who manages the firewall but not what the setting is.
A strong answer: “Remote administration of our boundary firewall is disabled. Our IT provider confirmed the setting this month and we hold a screenshot of the configuration. Management access is only possible from inside the network.”
Why it passes: It states the setting, when it was verified, and what evidence exists. Nothing is left for the assessor to wonder about.
A weak answer: “All staff use strong passwords.”
Why it struggles: It does not answer the question. The scheme asks how access is protected, service by service, and says nothing here about MFA, length rules or how any of it is enforced.
A strong answer: “MFA is enforced for every user on all our cloud services, checked in each admin console this week. Passwords are a minimum of 12 characters, enforced by policy rather than by asking nicely.”
Why it passes: Enforcement is the word that matters: it describes a setting rather than a hope, and it covers every user rather than most of them.
A weak answer: “We removed old software where possible.”
Why it struggles: “Where possible” is an admission that something unsupported may remain, and the assessor has to treat it that way.
A strong answer: “We ran a software inventory across all 34 in-scope devices this month. One machine was still running Windows 10, which left support in October 2025. It was replaced before this submission. No unsupported software remains in scope.”
Why it passes: It shows the check happened, names the finding honestly, and confirms it was fixed before submission rather than hidden. Assessors trust answers that admit and resolve.
A weak answer: “Updates are set to automatic.”
Why it struggles: Automatic is a setting rather than an outcome. Devices fall behind with automatic updates on, and the scheme requirement is that high-risk updates are applied within 14 days.
A strong answer: “Automatic updates are enabled on all in-scope devices, and we checked patch status across every device this month: the oldest outstanding critical update was six days old. Anything older than 14 days is chased weekly.”
Why it passes: It answers the requirement rather than the setting: updates are not just configured, they are verified to be landing on time.
A weak answer: “Only IT have admin rights.”
Why it struggles: It says who, but not how. The requirement is about separation: admin accounts used only for admin tasks, with daily work done on standard accounts.
A strong answer: “Three named people hold separate administrator accounts, used only for administration. Their day-to-day work happens on standard accounts. We reviewed the admin group this week and removed one account belonging to a former contractor.”
Why it passes: Separation is described exactly, and the removed contractor account shows the review really happened. Finding and fixing something is a better signal than claiming perfection.
A weak answer: “We have antivirus.”
Why it struggles: On which devices, doing what? The requirement differs by device type, and one word answers force the assessor to ask everything again.
A strong answer: “All laptops and desktops run endpoint protection with real-time scanning on, verified through the management dashboard. In-scope phones and tablets can only install apps from the official stores.”
Why it passes: It covers each device type with its own mechanism and says how the claim was verified, which is all the requirement asks.
A weak answer: “Head office only.”
Why it struggles: If staff work from home on company laptops, those devices are in scope wherever they sit, and a head-office-only scope will not survive review. Get scope wrong and every answer after it inherits the problem.
A strong answer: “Whole organisation: 34 laptops, 2 servers, and the cloud services listed, including staff working from home on company devices.”
Why it passes: Whole organisation scope is simpler to defend, covers home working honestly, and removes the follow-up questions a carve-out invites.
Notice the pattern across all seven: state the fact, say when and how it was checked, and admit what the check found. That is the entire art of the questionnaire, and it is also why answering from memory fails.
These are the mistakes that create avoidable pain.
This is the biggest problem.
If the scope is unclear, every answer that follows becomes unreliable.
A policy can say one thing while devices do another.
Certification is based on reality.
Maybe they have. Maybe they have not. Confirm it.
Many organisations still think mainly about laptops and servers, while Microsoft 365, Google Workspace, or AWS are where some of the most important controls need to be checked.
If the software is unsupported, that is a problem. The requirements document and IASME support materials make software support periods and current requirements a live issue rather than a theoretical one.
Rushing the submission is often the slowest route to certification.
This is where people either save time or create a mess.
If you are unsure:
The NCSC notes that IASME manages a network of hundreds of cyber security organisations across the UK that can advise and help you get certified. IASME also states that Certification Bodies can help you understand the assessment questions and how they apply to your organisation.
That is not a sign of weakness. It is normal. The smart move is to clarify uncertainty before you submit rather than after you fail.
If your goal is to pass first time, use this sequence.
Do a dry run before you touch the paid portal.
For each area, ask:
Do not submit and hope the assessor lets things slide.
Fix:
Look for contradictions and weak wording.
This can be your internal IT lead, your MSP, or your Certification Body support contact.
If you are planning certification this year, see our Cyber Essentials cost UK guide so you understand the real cost of certification, support and preparation before you start.
Cyber Essentials Plus starts with the verified self-assessment questionnaire. IASME says this clearly, and the NCSC’s published CE+ testing specification exists to support the independent technical assessment that follows.
That means the questionnaire is not just a formality. It is the base layer for CE+.
If the questionnaire is weak, Cyber Essentials Plus becomes much harder.
If the questionnaire is accurate and the environment truly matches it, the CE+ stage becomes more predictable.
If you plan to move beyond the verified self-assessment, our Cyber Essentials Plus guide explains how the technical audit works and what changes at the next stage.
When you answer the Cyber Essentials questionnaire, do not ask:
“What do I think the right answer is?”
Ask:
“What would an independent assessor see if they checked this today?”
That one shift in thinking will improve your answers immediately.
We sit on the other side of this process: Intelance is an IASME licensed certification body, so the people who review questionnaires are the people who wrote this guide. At published fixed prices:
The Cyber Essentials questionnaire is only difficult when the environment is unclear, inconsistent, or misunderstood.
If you know what is in scope, check the five controls properly, and answer based on evidence rather than hope, the questionnaire becomes manageable.
That is how you pass.
If you want help interpreting the Cyber Essentials questionnaire, validating your answers, and getting certified without delays or failed submissions, Speak to Intelance for a clear route to certification.
Yes. IASME publishes the current question set free of charge, and reading it before you start is the single best preparation step. Preview it, map each question to real evidence, and only then begin your submission.
Copy the style, never the sentences. The worked examples in this guide show what assessors accept: specific, dated, checkable statements about your own environment. Recycled wording from someone else’s submission describes someone else’s network, and assessors spot it instantly.
The structure is stable but IASME updates the scheme annually, and the April 2026 update changed several requirements. Check the current question set rather than working from last year’s answers, and see our Cyber Essentials 2026 guide for what changed.
Scope. If the scope is wrong, every answer that follows inherits the problem. The second biggest is answering from policy or memory instead of checking live systems, which is how confident submissions fail.
Unclear or contradictory answers come back as follow-up questions, which slows certification. Answers that claim controls you do not have are worse: they surface at Cyber Essentials Plus, where an auditor tests reality against your questionnaire, and failed audits cost real money. Accurate answers that admit a fixed problem beat polished answers that hide one.
A few hours if you have prepared: scope confirmed, systems checked, evidence to hand. Days or weeks if you are discovering your environment as you answer, which is why the preparation steps in this guide come before the questionnaire rather than after.
They should, and early: much of the evidence lives with them. But the certification belongs to your organisation and a board member signs the declaration, so do not outsource the answers unseen. Ask your provider to show you the settings rather than just to reassure you.
Yes. Cyber Essentials Plus starts from a valid Cyber Essentials certificate, and the Plus audit tests your real environment against the answers you gave. A questionnaire answered accurately makes the Plus audit routine. An optimistic one makes it expensive.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
