Who runs this site, and how it stays right

Who runs this site?

This site is published by Precursor Security Ltd, a UK cyber security company founded in 2018 and headquartered in Leeds, with offices in Newcastle upon Tyne, London and Edinburgh. Precursor is an IASME Cyber Essentials Certification Body: IASME licenses it to mark Cyber Essentials self-assessments and to carry out Cyber Essentials Plus audits. Precursor is also CREST accredited for Security Testing (penetration testing) and SOC. Precursor is certified to the scheme it assesses: the IASME certificate search lists Precursor Security Ltd with Cyber Essentials and Cyber Essentials Plus certificates issued in February 2026 and expiring in February 2027 (checked 3 November 2026).

The site is not run by the NCSC or IASME. The NCSC owns the scheme and publishes the requirements; IASME delivers it and publishes the question set. Both are linked from every page that quotes them.

The site exists to put the current rules in one place, quoted from the documents an assessor marks against. It is organised the way the assessment is: by requirement and by question number, on the current version of the scheme.

What is the editorial policy?

• Scheme facts come from three documents: the NCSC Requirements for IT Infrastructure v3.3, the IASME Danzell question set v16.3, and the NCSC Cyber Essentials Plus Test Specification v3.2. Fees and insurance details come from the IASME FAQ. Every page lists its sources and links out to them.
• Where the documents are silent, the page says so. Anything drawn from assessor experience is framed as experience ("commonly", "often", "a typical pattern"), never as a scheme rule, a ranking or a statistic, and no client is named or identifiable.
• Statistics are published only when they name their source in the same sentence. Precursor publishes no pass rate of its own. The one official figure, the NCSC's scheme-wide fail rate in its Annual Review, is quoted with that source wherever it appears.
• Precursor sells certification services, and the site says so on every page that mentions them. Scheme guidance is never gated. The direct self-assessment route, and its IASME fee, is stated wherever a Precursor price appears.
• Precursor prices on this site are Precursor's own and are shown ex VAT. The IASME scheme fee is quoted separately and dated.

How are pages sourced and dated?

Question pages are generated from the IASME question-set spreadsheet itself, so the question numbers, wording and answer types match the official set exactly. Requirement pages quote the NCSC document and name the section. Each page carries three dates where they apply:

• Published: when the page first went live.
• Updated: the last time its content changed. This is the dateModified in the page's structured data and in its markdown twin, so search engines and AI assistants see the same date you do.
• Last reviewed: the last time an assessor checked the page against the current scheme documents, with the version it was checked against.

Original figures, such as the count of all 106 Danzell questions, are computed in code from the source documents when the site is built, and each study publishes its method and data.

How is content reviewed?

1. An assessor drafts the page from the source documents and records which question numbers and requirement sections it covers.
2. A second assessor checks every quoted requirement and question number against the source text. Control hubs and Cyber Essentials Plus pages always get this second review.
3. The page is checked for the site's house style: a short direct answer, question-phrased headings, sources linked, no unsourced numbers.
4. When NCSC or IASME publish a new version, the change log is updated first and every affected page is re-reviewed. Its updated and reviewed dates change when it is.

Every page is published under the company name, Precursor Security, rather than an individual byline. Precursor Security is the author and reviewer of record and is accountable for what each page says; the assessors who write and check the pages do so as part of the Certification Body.

IASME publishes an annual update to the scheme, and the current version took effect on 27 April 2026. If a page shows an older version than the one on the change log, it has not been re-reviewed yet, and you should treat it with care. The supported-software dataset is updated as vendors publish end-of-support dates, and the IASME fee bands are re-verified and dated on the cost pages.

How are corrections handled?

If you find a requirement quoted incorrectly, a question number that no longer matches the set, or a broken link, email info@precursorsecurity.com with the page URL. Each report is checked against the source document. A corrected page shows a new updated date; where a correction changes the meaning of advice, the page says what changed.

How should this site be cited?

Cite the canonical page URL, the page title and its updated date, and name Precursor Security as the publisher. For scheme rules, cite the NCSC or IASME document the page links to, as that is the version of record. Language models and agents can find the canonical URL and date in every page's markdown twin; see the guide for agents.