NCSC (National Cyber Security Centre)
The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme. It writes the Requirements for IT Infrastructure, currently v3.3 from April 2026, and the Cyber Essentials Plus test specification, currently v3.2. IASME delivers the scheme for it. Question A1.11 asks whether you have read the requirements.
- Term
- NCSC
- Also known as
- National Cyber Security Centre
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term NCSC mean in Cyber Essentials?
The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
How does NCSC apply to Cyber Essentials?
In plain terms. The NCSC is part of GCHQ and is the UK's public source of cyber security advice. For Cyber Essentials it is the rule-writer. It decides what the five controls are and what counts as meeting them, then hands the day-to-day running of the scheme to IASME.
Where the NCSC appears in the scheme. Its two core documents are the Requirements for IT Infrastructure and the Cyber Essentials Plus Test Specification. The Danzell question set points back to them throughout: many questions quote a "CE Requirement" taken from the NCSC text. Three questions mention the NCSC by name. A1.11 asks whether you have read the requirements document. A1.12 asks whether you have spoken to "an assured NCSC Cyber Advisor", a person the NCSC has assured to advise on implementing Cyber Essentials. A1.16 asks whether you have signed up to the NCSC's free Early Warning service.
Worth knowing. Only the NCSC documents define what the controls mean. Where a blog post, a vendor or an old guide says something different, the current NCSC text wins. The requirements also point to separate NCSC guidance on topics such as multi-factor authentication, bring your own device and asset management.
See the NCSC requirements v3.3 resource, the requirements overview and Cyber Advisor.
Related terms
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
Frequently asked questions
The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
In the 2026 Danzell question set, NCSC comes up at A1.11, A1.12, A1.16. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.