Check your readiness
v3.1 · Montpellier question set

Cyber Essentials changes April 2023: Montpellier question set and requirements v3.1

What changed in Cyber Essentials requirements v3.1 and the Montpellier question set from April 2023: firmware in scope, third-party devices, device unlocking, malware protection and zero trust.

Superseded
Updated 3 November 2026
Superseded
This version is no longer used for new assessments. The current version is v3.3 with the Danzell question set; read the 2026 changes.
Short answer

Cyber Essentials requirements v3.1 and the Montpellier question set applied from 24 April 2023. It was a clarification release: the NCSC's what's new list covers firmware in the software definition, why asset management matters, a BYOD guidance link, third-party devices, device unlocking where vendors restrict settings, an updated malware protection section and new zero trust guidance.

Key facts
Requirements
Cyber Essentials: Requirements for IT infrastructure v3.1, April 2023
Question set
Montpellier (IASME question set version 14, January 2023)
Effective
24 April 2023
Preceded by
v3.0 and the Evendine question set, January 2022
Superseded by
v3.2 and Willow, 28 April 2025
Published
24 April 2023

What changed in Cyber Essentials v3.1?

Cyber Essentials v3.1 made 5 changes: firmware and the software definition; asset management and BYOD; third-party devices clarified; device unlocking and vendor restrictions; malware protection and zero trust.

The items below summarise the version's changes, with the questions each touched.

  1. Firmware and the software definition

    The definition of software was updated to clarify where firmware is in scope. v3.3 still treats firmware as part of the operating system for support and update purposes, which is why A6.4 names router and firewall firmware.

    QuestionsA6.1A6.4AUTO-FAIL

  2. Asset management and BYOD

    A statement was added on why asset management matters in Cyber Essentials, and a link to the NCSC's BYOD guidance was added for information. The device lists in A2.6 to A2.8 are where that asset knowledge shows.

    QuestionsA2.6A2.7A2.8BYOD scope

  3. Third-party devices clarified

    The requirements clarified how devices used by third parties, such as contractors, are treated. The same scope tables carry through to v3.3.

    QuestionsA2.1Scope overview

  4. Device unlocking and vendor restrictions

    The device unlocking section was updated to reflect that some configuration cannot be altered because of vendor restrictions. v3.3 keeps the rule: where the vendor does not allow throttling or lockout to be configured, use the vendor's default setting.

    QuestionsA5.9A5.10

  5. Malware protection and zero trust

    The malware protection section was updated, and new information explained how using a zero trust architecture affects Cyber Essentials. Zero trust guidance still sits in the further guidance section of v3.3.

    QuestionsA8.1

When did Cyber Essentials v3.1 take effect?

Cyber Essentials v3.1 and the Montpellier question set took effect on 24 April 2023. It has since been superseded and is no longer used for new assessments.

Which questions changed in v3.1?

9 questions are affected by the v3.1 changes. Each links to its question page with the current wording and what a compliant answer looks like.

A2.1A2.6A2.7A2.8A5.9A5.10A6.1A6.4AUTO-FAILA8.1

Other versions and related pages

Frequently asked questions

The question set that accompanied the January 2022 overhaul of the scheme, requirements v3.0. IASME describes that update as a major overhaul made necessary by the digital transformation the pandemic accelerated, and it mandated MFA for accounts and services available over the internet. The IASME changelog records the move to Evendine in November 2021.

The structure of the question set and the scope tables largely carry through to Danzell. Reading the current version is enough; earlier versions are for context.

Each NCSC requirements document opens with a 'What's new in this version' list, IASME publishes an article before each annual update, and the changelog sheet in the IASME question set spreadsheet records every revision back to March 2021.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources