Applicant
An applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact. In the Danzell question set the applicant is the one legal entity named at A1.1, which appears on the certificate. The applicant, not its Certification Body or IT supplier, is responsible for meeting every requirement in its scope.
- Term
- Applicant
- Category
- Scheme and certification
- Requirement area
- B. Definitions
- Reviewed against
- Requirements v3.3
What does the term applicant mean in Cyber Essentials?
An applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
Applicant refers to the organisation which is seeking certification, or sometimes the individual who is acting as the main point of contact, depending on context.
How does applicant apply to Cyber Essentials?
In plain terms
The applicant is whoever is asking to be certified. Usually that means the company, charity or other legal entity whose name goes on the certificate. Sometimes it means the person filling in the form for it. The NCSC definition, quoted above, covers both.
How the question set uses it
- A1.1 asks for the name of "just one legal entity, which will be displayed on your certificate", up to 150 characters, with a trading name allowed alongside it.
- A1.4 asks for that entity's registration number, which "must correspond to the Organisation name entered in A1.1".
- A1.6 and A1.6.1 add other legal entities that share the same IT infrastructure and network and the same board-level signatory. After the main certificate is issued, each can buy its own certificate "priced at £10 per certificate".
- A2.10 asks who manages your IT. The guidance says this person "must be a member of your organisation and cannot be a person employed by your outsourced IT provider."
Who is responsible?
The applicant, not the Certification Body or an MSP. Section A of the requirements says: "As a Cyber Essentials scheme applicant organisation, it's your responsibility to make sure that your organisation meets all the requirements." Where a third party runs your IT, you still answer for the controls, and a board-level person in your organisation signs the board declaration.
Common mistakes
- Entering a trading name where the legal entity should be, so the certificate does not match the contract.
- Naming the IT supplier at A2.10.
- Forgetting a subsidiary at A1.6. Legal entities not listed there "cannot be added after the certification process is complete."
See scope: third-party accounts and MSPs, the organisation questions and the Cyber Essentials certificate.
Related terms
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
- Cyber Essentials certificateA Cyber Essentials certificate is the digital record, issued through a Certification Body, that an organisation has passed Cyber Essentials or Cyber Essentials Plus.
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
- Certificate registerThe certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
Frequently asked questions
An applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, applicant comes up at A1.1, A1.4, A1.6, A1.6.1, A2.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Applicant relates to B. Definitions in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.