Self-assessment questionnaire
The self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials. In 2026 it is the IASME Danzell question set, completed in the Pervade portal. A board-level person validates the answers, then a Certification Body assessor marks them. Passing it is also the prerequisite for Cyber Essentials Plus.
- Term
- Self-assessment questionnaire
- Also known as
- SAQ, self-assessment, Cyber Essentials self-assessment
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term self-assessment questionnaire mean in Cyber Essentials?
The self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
How does self-assessment questionnaire apply to Cyber Essentials?
In plain terms. It is like a tax return for your IT. You describe your own set-up honestly, someone senior signs to say it is true, and a qualified person checks it for anything that does not add up. Nobody visits your office for the basic level.
What Cyber Essentials asks. Answers are a mix of Yes or No, multiple choice and free-text notes fields. The notes answers matter most, because the assessor marks what you describe, not what you intend. At A6.2.1 to A6.2.4 you list your browsers, anti-malware, email and office software with version numbers so the assessor can check each one is still supported. The final attestation asks whether all answers have been validated by "an appropriate person, such as a board-level representative", and a submission that a board member has not validated is returned.
How it runs, step by step.
- Read the questions first. IASME publishes the full question set free of charge, and the Danzell question set is explained question by question on this site.
- Apply and pay the scheme fee, through a Certification Body. IASME's terms (clause 2.1) say access to the questionnaire is given "upon receipt of the Fee".
- Answer every question. IASME allows "6 months from the date of application to complete and submit your assessment"; after that "your account may be closed" and you would apply and pay again.
- A board-level person validates the answers and signs the declaration.
- The assessor marks the answers. IASME says every applicant receives "a report including all the answers you gave and comments from the Assessor" against anything non-compliant.
- On a pass, the certificate is "valid for 12 months from the date of issue" (IASME terms, clause 2.4).
Common mistakes. Answering Yes where the honest answer is "mostly". The guidance at A6.4 and A6.5 is plain: "If you cannot achieve this requirement at all times, you will not achieve compliance to this question." Another is leaving notes fields vague, which invites a query or a fail. If a submission does fail, IASME gives one free re-mark if you resubmit within 48 hours of the fail notice.
Sources: the IASME Cyber Essentials FAQ and scheme terms and conditions.
See how to get certified, self-assessment vs using an assessor and the Danzell question set.
Related terms
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- Re-markA re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
- Danzell question setThe Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Test caseA test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
Frequently asked questions
The self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.