Board declaration
The board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate. It is the attestation at the end of the Danzell question set, and IASME returns any submission a board member has not validated. The signer must have authority for every legal entity listed at A1.6.
- Term
- Board declaration
- Also known as
- attestation, board sign-off, declaration
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- A1.6
- Reviewed against
- Requirements v3.3
What does the term board declaration mean in Cyber Essentials?
The board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
How does board declaration apply to Cyber Essentials?
In plain terms
It is the "I confirm this is true" signature at the bottom of the form. Like signing off company accounts, it puts a named, senior person behind the answers, which is why it should not be handed to whoever filled the form in.
What the question set says
The attestation asks: "Have all the answers provided in this assessment been validated by an appropriate person, such as a board-level representative, prior to submission?" The guidance defines an appropriate person as "someone who is an officer of the company, typically a director or board member, and has the associated legal authority and duties", and warns: "The submission will be returned if it has not been validated by a board member." The insurance section adds that the declaration should be signed "by Board level or equivalent, to avoid any delays to the insurance policy being issued". Where several legal entities share one certificate, A1.6 says "The board member signing off on the certificate must have the authority to represent all the listed legal entities."
What an assessor looks for
A signer who actually holds that authority. An IT manager or an outsourced IT company is not an officer of the organisation. Organisations without a board, such as sole traders and partnerships, use the person with equivalent legal authority.
See how to get certified, what Cyber Essentials is and applicant.
Related terms
- ApplicantAn applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
- Certificate registerThe certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- CRESTCREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
Frequently asked questions
The board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
In the 2026 Danzell question set, board declaration comes up at A1.6. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.