Encryption
Encryption is scrambling information with a secret key so that only someone holding the right key can read it. Cyber Essentials v3.3 has no encryption requirement and no Danzell question asks about it. It appears in the requirements only in a ransomware example, where criminals use it to lock your files.
- Term
- Encryption
- Also known as
- Data encryption
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term encryption mean in Cyber Essentials?
Encryption is scrambling information with a secret key so that only someone holding the right key can read it.
How does encryption apply to Cyber Essentials?
In plain terms
Encryption is a lock for information rather than for a door. A document, an email or a whole laptop is turned into gibberish that only makes sense to someone with the key. If a thief takes an encrypted laptop from a car, they get the hardware but not your client files. The padlock in your browser's address bar means your connection to that website is encrypted in the same way.
What Cyber Essentials asks
Nothing. The five controls are firewalls, secure configuration, security update management, user access control and malware protection. Encryption is not one of them, and neither the v3.3 requirements, the Danzell question set nor the Cyber Essentials Plus test specification v3.2 asks whether your data or devices are encrypted.
The only mention is in the user access control section, where ransomware "encrypts all of the data on the network and then demands a ransom." Criminals use encryption too.
Encryption is still worth having. It protects data on a lost or stolen device, and customers, insurers and other frameworks may ask for it even though Cyber Essentials does not.
Common mistakes
- Treating encryption as a substitute for a control. An encrypted laptop still needs updates within 14 days, malware protection and a separate admin account.
- Describing encryption at A8.1 option C as malware protection. It does not stop malware running, and A8.1 needs anti-malware software or application allow listing.
See what Cyber Essentials covers. Related: full-disk encryption, ransomware.
Related terms
- Full-disk encryptionFull-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- ExploitAn exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
Frequently asked questions
Encryption is scrambling information with a secret key so that only someone holding the right key can read it.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.