Requirements for IT Infrastructure
Cyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials. Version 3.3, dated April 2026, is current and underpins the Danzell question set. It defines key terms, sets scope rules and lists the requirements under five technical controls. A1.11 asks whether you have read it.
- Term
- Requirements for IT Infrastructure
- Also known as
- Cyber Essentials: Requirements for IT Infrastructure, NCSC requirements v3.3, Cyber Essentials requirements
- Category
- Scheme and certification
- Requirement area
- A. Introducing the technical controls
- Questions
- A1.11
- Reviewed against
- Requirements v3.3
What does the term Requirements for IT Infrastructure mean in Cyber Essentials?
Cyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
How does Requirements for IT Infrastructure apply to Cyber Essentials?
In plain terms. It is the rulebook. The question set asks the questions and the assessor marks them, but this document decides what the right answers are. When there is doubt about what a control means, this is the text that settles it.
What it contains. Version 3.3 runs from section A to F: an introduction to the five technical controls, definitions of terms such as scope, software and cloud service, a note on backing up data, the scope rules (including bring your own device, home working, wireless devices, cloud services, third-party accounts and software development), the requirements for each of the five controls, and further guidance on zero trust. Its "What's new" list for v3.3 includes a definition of cloud services, FIDO2 in the passwordless definition, a "Definitive statement that cloud services cannot be excluded from scope", and more emphasis on backing up data.
The Danzell question set quotes it throughout. Most technical questions carry a "CE Requirement" line taken from it, and A1.11 asks: "Have you read the 'Cyber Essentials Requirements for IT Infrastructure' document?"
Common mistakes. Working from an older version. v3.2 paired with the superseded Willow question set; the current pairing is v3.3 with Danzell. Another is reading only the question set and missing the definitions in section B, which decide what counts as a device, a server or a cloud service.
See the NCSC requirements v3.3 resource, the requirements overview and NCSC.
Related terms
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
- SamplingSampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
Frequently asked questions
Cyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
In the 2026 Danzell question set, Requirements for IT Infrastructure comes up at A1.11. Read those questions against the definition above so your answers use the term the way the assessor will.
Requirements for IT Infrastructure relates to A. Introducing the technical controls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.