All services Every engagement has a fixed, published price. Book a strategy call
Every Cyber Essentials requirement, current to v3.3 and the Danzell question set: the five control areas with what the assessor expects, the scope rules, the two auto-fail requirements, what the scheme does not require, and a complete checklist.
This is a complete reference to the Cyber Essentials requirements UK organisations must meet, with every one of the requirements explained in plain terms, current to the Requirements for IT Infrastructure v3.3 and the Danzell question set that apply from 26 April 2026. It is written by an IASME licensed certification body, which means our assessors mark submissions against exactly these requirements, and the tables below describe what they expect to see rather than a paraphrase of the brochure.
The short version. Cyber Essentials requires five families of technical controls across every in-scope device and cloud service: firewalls, secure configuration, user access control, malware protection and security update management. Scope covers the whole organisation by default, including phones, home workers and every cloud service you use. Two requirements are now marked as automatic failures: multi-factor authentication missing from any cloud service that offers it, and high-risk security updates applied slower than 14 days. Everything else is detail, and the detail is below.
The Cyber Essentials requirements come in two layers, and together they define the Cyber Essentials controls in full. The five control areas define what must be true of your technology, and the scope rules define which technology it must be true of. A director then signs a declaration that the answers are accurate and, since 2026, that the controls will be maintained throughout the certification year.
| Control area | What it requires, in one line | Auto-fail exposure |
|---|---|---|
| 1. Firewalls | A configured firewall between your devices and the internet, with default passwords changed and no unapproved inbound services | Marked strictly. Not a named auto-fail |
| 2. Secure configuration | Devices and software stripped of defaults: unused accounts and apps removed, auto-run off, device locking on | Marked strictly. Not a named auto-fail |
| 3. User access control | Unique accounts, prompt removal for leavers, admin rights separated, MFA on cloud services, strong password rules | MFA missing from any cloud service that offers it fails the assessment |
| 4. Malware protection | Every in-scope device protected by anti-malware software or an approved application list | Marked strictly. Not a named auto-fail |
| 5. Security update management | Everything licensed and supported, auto-updates on where possible, high-risk fixes within 14 days | Questions A6.4 and A6.5 fail the assessment outright if answered no |
Scope is where most confusion lives, so settle it before reading a single control. Cyber Essentials applies to the whole organisation by default, and under v3.3 any exclusion must be justified and the excluded network shown to be segregated. Cloud services can never be excluded.
| In scope | Out of scope | Commonly missed |
|---|---|---|
| Laptops, desktops and servers that access organisational data or services | Devices that genuinely cannot reach organisational data or the internet | The old machine in the corner that still has a mapped drive |
| Phones and tablets used for business, including personal devices used for work email or data | Personal devices used only for calls and texts | Staff phones with the company email app installed: they are in scope |
| Every cloud service that stores or processes your data, accessed via an account | Nothing: cloud services cannot be excluded | The accounting platform, the CRM, the file-sharing tool someone signed up for |
| Firewalls and routers at your boundaries, including home routers for home workers using them for business | Networks fully segregated from in-scope systems, with the segregation explained | Home workers: their devices are in scope wherever they sit |
| The requirement | What the assessor expects |
|---|---|
| A firewall at every internet boundary | A correctly configured firewall or router protecting the connection, with a software firewall active on devices used away from the office |
| Default passwords changed | Router and firewall admin passwords changed from factory defaults, and strong |
| No unauthenticated inbound services | Inbound connections blocked by default. Anything opened is documented, justified and approved by a named person |
| Remote administration locked down | Managing the firewall from the internet disabled, or protected with MFA or IP restrictions if genuinely needed |
Where organisations fail: the router still on its factory password, and firewall rules opened for a project years ago that nobody can explain, which is exactly what the documentation requirement exists to catch.
| The requirement | What the assessor expects |
|---|---|
| Unused accounts and software removed | Guest accounts, sample apps and anything not needed for business disabled or uninstalled across in-scope devices |
| Default passwords changed everywhere | No device or service still using the credentials it shipped with |
| Auto-run disabled | Files and media do not execute automatically when inserted or downloaded |
| Device locking enforced | Devices unlock with biometrics, a password, or a PIN of at least six characters. Locking is automatic rather than optional |
Where organisations fail: configuration drift. Devices were set up correctly once, then years of convenience decisions accumulated, and nobody has audited a laptop since it was issued. The requirement is a state to maintain rather than a setup step.
The heaviest-weighted area, and home to the first auto-fail rule. The Cyber Essentials technical requirements here are precise, so this table is worth reading twice.
| The requirement | What the assessor expects |
|---|---|
| Unique accounts, controlled creation | Every person has their own account, created through an approval process, with no sharing |
| Leavers removed promptly | Accounts disabled when people leave, and a process that makes this happen rather than a hope |
| Admin rights separated | Day-to-day work happens in standard accounts. Administrator accounts exist separately, are used only for admin tasks, and are reviewed |
| MFA on all cloud services | Multi-factor authentication enabled for every user on every cloud service that offers it, free or paid. From April 2026 a missing MFA control fails the whole assessment |
| Password rules | With MFA: passwords of at least 8 characters. Without MFA: at least 12 characters, or at least 8 with automatic blocking of common passwords. Passwordless methods such as passkeys are an accepted alternative |
| Brute force protection | Throttled attempts or account lockout so passwords cannot be guessed at machine speed |
Where organisations fail: MFA enabled for most people but not the directors who found it annoying, and admin rights granted broadly in a busy week years ago. Both are now assessment-enders rather than awkward answers.
| The requirement | What the assessor expects |
|---|---|
| Every in-scope device protected | One of the permitted mechanisms active on each device rather than most devices |
| Option one: anti-malware software | Installed, kept up to date, scanning files on access and blocking access to known malicious websites |
| Option two: an approved application list | Only applications on an approved list can run. For phones and tablets, restricting installs to official app stores with an approved list is the practical route |
Where organisations fail: assuming built-in protection is configured just because it exists, and forgetting phones entirely. Note that sandboxing alone is no longer an accepted route. The current scheme expects one of the two options above.
Security update management, often called patch management, is home to the second auto-fail rule, and statistically the requirement most likely to fail an otherwise tidy organisation.
| The requirement | What the assessor expects |
|---|---|
| Everything licensed and supported | Operating systems and applications within their support life. Anything unsupported removed or properly segregated out of scope |
| Automatic updates on where possible | Auto-update enabled across devices and software that support it |
| High-risk fixes within 14 days | High-risk or critical security updates and vulnerability fixes applied within 14 days of release, for operating systems, firmware and applications. Questions A6.4 and A6.5 make a no answer an automatic failure from April 2026 |
Where organisations fail: one forgotten machine running an out-of-support operating system, and update processes that rely on users clicking restart. Fourteen days is measured from release rather than from when somebody noticed.
Knowing the boundary saves money. Cyber Essentials does not require written security policies, staff training programmes, logging and monitoring, a security operations centre, penetration testing, or backups, though backups are strongly recommended and the guidance now emphasises them. It does not require any particular product or vendor, and it does not require an information security management system: that is ISO 27001 territory. Anyone quoting you for those things as part of Cyber Essentials certification is selling something beyond the scheme, which is fine only if the quote says so.
Cyber Essentials Plus requirements start from the same five control areas. Nothing new is demanded of your configuration. What changes is verification: an assessor tests a sample of your devices directly with vulnerability scans, checks that malware protection works in practice, tests how email attachments and browser downloads are handled, and confirms account separation is real. The Plus audit must be completed within the required window after the basic certification, and under the 2026 rules a failed device sample means the retest examines a fresh random sample too, with a second failure revoking the underlying certificate. Preparation, in other words, is now considerably cheaper than optimism. Details and pricing are on our Cyber Essentials Plus page.
The certification requirements are checked through a verified self-assessment: you answer the Danzell question set, a board member or director signs a declaration that the answers are true and that the controls will be maintained through the year, and a qualified assessor at a licensed certification body marks the submission, with a window to correct anything queried. There is no site visit at the basic level, which leads some organisations to treat the questionnaire as creative writing. Two reasons not to: the declaration is a formal commitment signed at board level, and if you later take Cyber Essentials Plus, the audit tests reality against your locked answers. Answers must match the estate, because eventually something checks.
Scope: all devices listed, including phones and home workers · every cloud service identified · exclusions justified and segregated.
Firewalls: boundary firewall configured · default passwords changed · inbound blocked by default, exceptions documented · remote admin disabled or protected.
Secure configuration: unused accounts and software gone · no default credentials · auto-run off · device locking with biometrics, password or six character minimum PIN.
Access control: unique accounts · leavers removed promptly · admin accounts separate and reviewed · MFA on every cloud service · password rules met · brute force protection on.
Malware: anti-malware or an approved application list on every device, phones included.
Updates: everything supported and licensed · auto-updates on · high-risk fixes within 14 days, measured from release.
Governance: a director ready to sign, knowing the signature now covers the whole year.
We are the certification body, so our help maps exactly onto the requirements above. Cyber Essentials certification at the official fee of £320 to £600 + VAT by organisation size. Guided certification at £950 + VAT where our assessors work through every requirement in this article with you and tell you precisely what to fix, and Cyber Essentials Plus at £1,150 + VAT, fixed. For budgeting the whole exercise, our cost guide has every number, and for what changed this year, the 2026 changes guide covers the new marking rules in full.
Five technical control areas applied across every in-scope device and cloud service: firewalls, secure configuration, user access control, malware protection and security update management, plus honest scoping and a signed director declaration. MFA on cloud services and 14 day high-risk patching are marked as automatic failures.
Yes. Multi-factor authentication must be enabled for every user on every cloud service that offers it, whether free or paid. From April 2026, a cloud service with MFA available but not enabled fails the assessment automatically.
With MFA in place, passwords need at least 8 characters. Without MFA, at least 12 characters, or at least 8 with automatic blocking of common passwords. Brute force protection through throttling or lockout is required, and passwordless methods such as passkeys are accepted.
Yes, if they access organisational data or services, including work email. Personal devices used only for calls and texts are out of scope. In-scope phones need supported operating systems, device locking and malware protection through official app stores and an approved list.
Yes, always. Version 3.3 defines a cloud service and states that services storing or processing your organisation’s data cannot be excluded from scope. Every one needs MFA enabled where available.
Basic certification is a verified self-assessment, so you declare rather than upload evidence, and a director signs for the truth of it. Cyber Essentials Plus verifies a sample of devices directly, and self-assessment answers are locked before Plus testing begins.
The scheme is reviewed annually. The current requirements are version 3.3 with the Danzell question set, applying to assessment accounts created after 26 April 2026, with a six month transition for accounts created earlier.
Many UK government contracts involving personal data or certain services require it, and some specify Cyber Essentials Plus. Where a contract names the scheme, only the named certification satisfies it.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Based on the Cyber Essentials Requirements for IT Infrastructure v3.3. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
