Last year's Cyber Essentials answers say twelve laptops. You have fourteen now, one new payroll service and a different IT supplier. Which answers need another look?
A change log helps you find them. Record changes that could make an assessment answer untrue, then distinguish what was planned from what actually happened. An invoice or approval isn't proof that a device was configured or an old account removed.
IASME describes Cyber Essentials as an annual certification. The log below is a suggested working tool, not a required scheme template.
Decide what earns a line
Record a change when it affects the assessed systems or one of their controls. Useful triggers include adding a work device, changing a cloud service, replacing a router, granting supplier access or discovering that a product's security support is ending.
You don't need an entry for every support conversation. Ask: “Could this change the facts behind an assessment answer?” If yes, keep enough detail to find the affected answer and check its current position.
For each entry, capture:
- Before and after: what changed, using recognisable device or service references.
- Answers to revisit: the relevant scope, configuration, access, protection or update questions.
- Current status: planned, in use but unchecked, or checked.
- Outstanding work: a specific next action and who will do it.
- Checked result: the date and a link to the relevant secure record.
Keep passwords, recovery codes and configuration secrets out of the log.
Follow a change past the purchase
Imagine a fictional design studio buying three laptops for temporary workers. Its first entry reads:
Three laptops ordered for the summer project. Revisit device numbers and the answers about configuration, accounts, malware protection and updates. Status: planned. Setup and confirmation still needed.
After delivery, “purchased” becomes “in use but unchecked”. That distinction matters if the project starts before setup finishes.
The completed entry might read:
Three laptops added to the current device list. The setup check records their versions, normal user accounts, protection and update status. Status: checked on 8 June. The separate setup record contains the technical details.
When the project ends, don't overwrite that history with “project complete”. Add what happened to the devices and accounts. A returned laptop, one reassigned to a new employee and one still held by a temporary worker need different follow-up.
The useful record follows the change through its consequences. It doesn't treat a manager's spending approval as the final step.
Use the log to challenge renewal answers
Keep last year's submitted answers as a dated snapshot. Beside them, work through the changes recorded since certification.
For the studio, the device-count answer needs the current list. The temporary workers' departure means checking the access answer too. Neither can be settled by adding three to last year's total.
Then compare the answers with the question set applicable to the new assessment. A quiet year in your business doesn't mean the scheme questions stayed the same.
The April 2026 scheme update also makes the declaration about maintaining the controls throughout the certification period explicit. Record and resolve a gap when it appears, rather than saving it for renewal.
Before submitting, every affected answer should point to either a confirmed present fact or visible unfinished work. If a line still says “waiting for setup”, you have found a task to finish, not an answer to copy.