What an assessor actually reads in your notes field

The Danzell question set has 106 questions. 40 take a yes or no and 12 offer set options. The other 54, marked "Notes" in the answer-type column, ask you to describe something: a process, a list, a setting. Those counts come from our analysis of the question set, and in our marking the notes boxes decide most of the queries we send back.

What is the assessor checking in a notes answer?

In sections A4 to A8, 17 of the 26 notes questions quote the NCSC requirement in their guidance under a "CE Requirement" label. The assessor reads your answer against that sentence, or against the requirement the question enforces where none is quoted, and asks three questions.

The third check is where most answers fall down. "Strong passwords" is not a technical control. "Minimum 12 characters enforced by the domain password policy in Group Policy, no expiry" is.

Which notes fields get the most queries?

In our experience, these five boxes are commonly sent back with a query.

A7.3 asks how you delete or disable leavers' accounts. The answer needs a trigger and an action: "HR emails IT on the leaver's last day; the account is disabled in Entra ID the same day and deleted after 30 days." An answer that says "we remove access when people leave" describes an intention, not a process.

A7.6 asks how separate accounts are used for administrative tasks. Name the accounts: "Each of the two IT staff has a standard user account for daily work and a separate admin account, used only for Intune, Entra and server changes." If one person is the whole IT team, say so and still describe the two accounts.

A6.4.2 only applies where auto-update is not used, and it is the box that catches organisations who tick "no" to auto-update without a replacement. The requirement is 14 days from release for critical and high-risk fixes. Say what tool reports compliance and who reads it.

A2.4 is a list of networks by name, location and purpose. The guidance is explicit: no IP addresses, no development or penetration-testing networks. A CIDR range in this box is a query, not a bonus. "Head office network, Leeds, staff and admin use; home working, staff connect over home broadband" is the level of detail it asks for.

A7.1 asks for the account creation and approval process. The guidance says accounts are only provided after approval by a person with a leadership role in the business, so name that role: "The line manager requests the account through the IT ticket form; a director approves it in the ticket before IT creates it in Entra ID."

Does the wording need to quote the requirement?

No, and copying the requirement text back is a warning sign. Assessors see "All software on in-scope devices must be updated within 14 days of release" pasted into A6.4.2 several times a week. It tells us you have read the guidance and nothing about your organisation.

A good pattern is control, mechanism, owner, evidence:

• Control: what you do ("critical and high-risk updates are installed within 14 days")
• Mechanism: what enforces it ("Intune update rings with a 7-day deferral, plus Chrome and Edge auto-update")
• Owner: who checks ("the IT lead reviews the Intune compliance report every Monday")
• Evidence: what you could show ("the report is exported and kept for 12 months")

You do not upload evidence for the self-assessment. Writing as though you might is the quickest route to a specific answer.

Where do the model answers come from?

Every notes answer we rate as complete has the same shape: what the setting is, where it is applied, who owns it and how you would know if it changed. The question index links to a page for every question in the 2026 set, and each one explains what the assessor is looking for, what a complete notes answer contains and why. If you want a second pair of eyes before you submit, a fixed-price certification includes a pre-submission review of your answers.