Evidence
Evidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place. The NCSC requirements say a Certification Body may ask for it before awarding certification. For the self-assessment, your notes answers carry most of the weight. For Cyber Essentials Plus, the assessor gathers evidence by scanning and testing.
- Term
- Evidence
- Also known as
- supporting evidence, evidence pack
- Category
- Scheme and certification
- Requirement area
- A. Introducing the technical controls
- Reviewed against
- Requirements v3.3
What does the term evidence mean in Cyber Essentials?
Evidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
As a Cyber Essentials scheme applicant organisation, it's your responsibility to make sure that your organisation meets all the requirements. You might also be required to supply evidence before your Certification Body can award certification at the level for which you’re applying.
How does evidence apply to Cyber Essentials?
In plain terms
Evidence is the receipt. Saying "we review our firewall rules" is a claim. A dated record of the last review, who did it and what changed is the proof.
What Cyber Essentials asks
Several questions ask you to show a process exists, not just that something happens. A4.8 asks how you approve and document allowed inbound connections, and the guidance says the business case "should be documented and recorded". A4.10 asks whether external access to firewall settings has a documented business requirement. A7.8 asks whether you formally track who has administrator accounts. For Cyber Essentials Plus, the NCSC test specification says evidence from the scope and segregation checks "is to be retained by the Certifying Body for at least the lifetime of the certificate", and the same applies to how the sample size was calculated.
What an assessor looks for
Answers specific enough to check: the tool, the setting, the person and the date. Useful things to keep ready are a device and software list with vendor support dates, screenshots of automatic update and MFA settings, your list of administrator accounts, firewall rule approvals, and a record of the last access review.
See the Cyber Essentials checklists, what an assessor reads in your notes field and assessor.
Related terms
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- IASME Cyber AssuranceIASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
- ISO 27001ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
Frequently asked questions
Evidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, evidence comes up at A4.8, A4.10, A7.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Evidence relates to A. Introducing the technical controls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.