A practical route through Cyber Essentials preparation.
Choose the guidance for the work in front of you. Start with scope, check the controls, then keep answers and evidence together so you can explain them.
These guides help with preparation. Use the official IASME question set and NCSC scheme information for authoritative requirements. Ask your Certification Body about assessment interpretations. RightCyber does not issue certificates or guarantee certification.
Step 1
Understand the scheme and budget
Start with the question set that applies to your assessment, what certification costs and any customer or tender requirements.
- Cyber Essentials Changes in 2026: Danzell and v3.3 Explained
Recheck cloud scope, MFA and 14-day patching against Danzell rather than carrying forward old answers.
- Cyber Essentials Cost in 2026: What You'll Really Pay
Budget for preparation, remediation and annual renewal as well as the official assessment fee.
- Cyber Essentials Tender Requirements: What PPN 014 Means for Your Bid
Read the tender wording carefully and prepare evidence for the exact Cyber Essentials requirement before award.
Step 2
Agree scope and responsibilities
Find the devices, services and accounts people actually use. Agree which work belongs to your organisation and which details your IT provider must confirm.
- Cyber Essentials Scope: Finding Your Cloud Services and Personal Devices
Start with how people do their jobs. Then decide which devices and cloud services are in scope, and who looks after them.
- Cyber Essentials: What to Ask Your IT Provider
Ask what your provider covers, what remains with your business and how unresolved work gets finished. Review answers you can understand before signing.
Step 3
Check the controls in daily use
Work through configuration, accounts, firewalls, malware protection and updates. Record unknowns and repair work before you declare an answer complete.
- The Cyber Essentials Firewall Questions, Explained in Plain English
Document each firewall, administrator route, inbound exception and rule review with current evidence.
- Cyber Essentials Secure Configuration: Preparing a Work Device
Write down what the device needs to do, then check its accounts, software and locking before you hand it over.
- Cyber Essentials: Keep Admin Access Out of Everyday Work
Make it easy to recognise which account is active and to get help with an administrative task. Check the arrangement in cloud services as well as on computers.
- Cyber Essentials: Is Your Malware Protection Actually Working?
Match protection reports to the devices people use, investigate missing results and follow an alert through to the person responsible for acting on it.
- Cyber Essentials Patching: A Workflow for the 14-Day Deadline
Count from the vendor's release date and check that each update finished. Leave time to fix failures and catch up with devices that are offline.
- Cyber Essentials: Make a Plan for Unsupported Software
Start with the software that would be hardest to replace. Confirm its support date, test the work that depends on it and give the change a named owner.
Step 4
Prepare answers and resolve gaps
Bring answers, evidence references and actions together. Review what you can support before the responsible person signs the declaration and you submit through the official assessment process.
- Cyber Essentials Self-Assessment 2026: Answers and Evidence
Confirm scope first, then answer each control from verified current evidence rather than assumptions.
- How Businesses Fail Cyber Essentials (And How Not to Pay Twice)
Check scope, MFA, supported software, patching and answer consistency before starting the assessment clock.
Keep the work useful at renewal
Saved answers are a starting point. Recheck the current questions, who has access, software support and what changed in your organisation. Record what you verified and the actions still open.
More Cyber Essentials guidance
Need somewhere to keep the preparation?
The desktop Workspace holds your preparation answers, evidence references and actions. Compare In-house for your own organisation and Consultant for separate clients.