Cyber Essentials checklists 2026

Every requirement in the NCSC Requirements for IT Infrastructure v3.3 across the five controls (firewalls, secure configuration, security update management, user access control and malware protection), the Danzell question that asks about each one, and the evidence you will need to answer it. The scope decisions come first, because every later row depends on them.

Start with the scope checklist if you have not yet decided between whole-organisation and sub-set scope. Then use the Cyber Essentials checklist to prepare the self-assessment. Use the Cyber Essentials Plus checklist only after the self-assessment passes, to prepare the sample for the audit.

Four Danzell questions fail automatically on a No answer: A6.4 and A6.5 on installing critical and high-risk updates within 14 days, and A7.16 and A7.17 on MFA for cloud administrators and users. A7.15 fails automatically if a listed cloud service does offer MFA. A6.3 and A6.6 on unsupported software are not automatic fails, but a non-compliant answer means the requirement is not met. Tick those rows first.

A completed checklist shows the controls are in place, but the assessor marks your answers to the question set, not the checklist. Use the evidence column to write specific notes fields: the product, the setting and the devices it applies to.