Assessor
An assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests. They read every answer, check listed software is supported and can query or fail non-compliant answers. For Plus, they verify scope, choose the device sample and record a pass or fail for each test case.
- Term
- Assessor
- Also known as
- Cyber Essentials assessor, IASME assessor
- Category
- Scheme and certification
- Requirement area
- D. Scope
- Reviewed against
- Requirements v3.3
What does the term assessor mean in Cyber Essentials?
An assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
How does assessor apply to Cyber Essentials?
In plain terms
The assessor is the examiner. You sit the paper and they mark it. For Cyber Essentials Plus they also run a practical: they scan your internet connection, look at a sample of laptops and phones, and watch staff sign in to cloud services.
What the scheme says
The NCSC requirements say that where parts of your infrastructure are excluded, "you will need to justify the reason for a partial scope to your assessor." The Danzell guidance at A6.2.1 to A6.2.4 asks for software versions so the assessor can verify each product is in support. The Cyber Essentials Plus test specification is "mostly aimed at personnel who actually conduct Cyber Essentials Plus assessments on behalf of Certification Bodies (the 'Assessor', or 'you')". It sets out what the assessor must do before testing, including getting written permission and verifying the scope by technical means.
What an assessor looks for
Specific answers. A notes field that names the tool, the setting and who checks it reads as a working control. A line such as "we follow best practice" reads as a gap. Answers are also read against each other: the devices you list at A2.6 should match the operating systems you say are supported at A6.1.
An assessor works for a Certification Body. That is different from a Cyber Advisor, who helps you prepare but does not certify.
See what an assessor reads in your notes field and before the Cyber Essentials Plus audit.
Related terms
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
- Certificate registerThe certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.
- CRESTCREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
Frequently asked questions
An assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
In the 2026 Danzell question set, assessor comes up at A6.2.1, A6.2.2, A6.2.3, A6.2.4. Read those questions against the definition above so your answers use the term the way the assessor will.
Assessor relates to D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.