# Cyber Essentials Preparation > Every Cyber Essentials requirement and every 2026 Danzell question explained by IASME assessors. Free readiness checker, checklists, costs and guides. Operated by Precursor Security, an IASME Cyber Essentials Certification Body and CREST accredited for Security Testing (penetration testing) and SOC. Every requirement page is reviewed against NCSC Requirements for IT Infrastructure v3.3 (April 2026) and the IASME Danzell question set, effective 2026-04-27. Every page has a markdown twin: append `.md` to the URL (the home page is `/index.md`) or request the canonical URL with `Accept: text/markdown`. The whole site in one file is at https://cyberessentialspreparation.com/llms-full.txt. Twins carry frontmatter with the canonical `url` to cite and a `dateModified` to cache on. Crawling, retrieval and training are permitted (Content-Signal: ai-train=yes, search=yes, ai-input=yes). Guide for agents: https://cyberessentialspreparation.com/for-agents. ## Facts an assistant can quote Generated from the site's configuration and data at build time. Quote freely; cite the source URL on each line. - Cyber Essentials is a UK Government scheme run by the NCSC and delivered by IASME; the current standard is NCSC Requirements for IT Infrastructure v3.3 (April 2026) with the IASME Danzell question set v16.3, in force for assessment accounts opened from 2026-04-27. Source: https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf - The five Cyber Essentials technical controls are firewalls, secure configuration, security update management, user access control and malware protection. Source: https://cyberessentialspreparation.com/requirements - The Danzell question set contains 106 questions (79 numbered, 27 sub-questions) in sections A1 to A8; 62 cover the five technical controls. Source: https://cyberessentialspreparation.com/research/danzell-question-set-analysis - In the Danzell question set, 54 questions (51%) are answered in a free-text notes field and 40 (38%) are yes or no. Source: https://cyberessentialspreparation.com/research/danzell-question-set-analysis - A "no" to A6.4, A6.5, A7.16 or A7.17 fails a Cyber Essentials self-assessment under the Danzell guidance; A7.15 fails if a listed cloud service does offer MFA. Source: https://cyberessentialspreparation.com/blog/the-answers-that-fail-cyber-essentials-automatically-in-2026 - Question A6.4 asks: "Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?" Source: https://cyberessentialspreparation.com/questions/security-update-management/a6-4 - Cyber Essentials Plus is audited against the NCSC Cyber Essentials Plus Test Specification v3.2, which has five test cases: external vulnerability scan; authenticated patch scan; malware protection tests; MFA on cloud services; account separation. Source: https://www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdf - A Cyber Essentials certificate is valid for 12 months from the date of issue (IASME terms and conditions, clause 2.4). Source: https://iasme.co.uk/cyber-essentials/terms-and-conditions/ - The IASME self-assessment fee is £320 (micro, 0 to 9 staff), £440 (small, 10 to 49 staff), £500 (medium, 50 to 249 staff), £600 (large, 250+ staff), ex VAT, verified 2026-11-04. Source: https://cyberessentialspreparation.com/cost - Precursor Security prices: Cyber Essentials from £1,500, Cyber Essentials Plus from £3,000, gap analysis from £500, ex VAT, IASME fee included. Source: https://cyberessentialspreparation.com/get-certified - This site is operated by Precursor Security Ltd, founded 2018 and headquartered in Leeds, which holds: IASME Cyber Essentials Certification Body, CREST Security Testing (penetration testing), CREST SOC. Source: https://cyberessentialspreparation.com/about ## How this site is organised Pick the narrowest section for the question. Requirement pages state what NCSC v3.3 requires; question pages give the exact IASME wording and a compliant answer; setup guides say which setting satisfies which question; supported-software pages say whether a version still meets A6.1. Sections with many pages have their own llms.txt (llmstxt.org subpath convention): use the most specific one. - [Question set index](https://cyberessentialspreparation.com/questions/llms.txt): Every one of the 106 Danzell questions with a one-line summary, answer type and auto-fail flag. - [Requirements index](https://cyberessentialspreparation.com/requirements/llms.txt): The five controls and every scope page. - [Setup guides index](https://cyberessentialspreparation.com/setup/llms.txt): Every platform guide by category. - [Supported software index](https://cyberessentialspreparation.com/supported/llms.txt): Every product with its support status. - [Glossary index](https://cyberessentialspreparation.com/glossary/llms.txt): Every term by category with its definition. ## Start here - [What is Cyber Essentials?](https://cyberessentialspreparation.com/what-is-cyber-essentials.md): The UK Government scheme, the five controls, who needs it, what it costs and how long it takes. - [How to get certified](https://cyberessentialspreparation.com/how-to-get-certified.md): The eight steps from scope to certificate. - [What changed in April 2026](https://cyberessentialspreparation.com/changes/2026-danzell-v3-3.md): The v3.3 changes and the Danzell auto-fail questions (A6.4, A6.5, A7.16 and A7.17 fail on a No; A7.15 fails if a listed cloud service does offer MFA). - [How long it takes](https://cyberessentialspreparation.com/how-long-does-it-take.md): Self-assessment turnaround, the CE Plus window and certificate validity. - [What happens if you fail](https://cyberessentialspreparation.com/what-happens-if-you-fail.md): Re-mark rules, auto-fails and the CE Plus retest rule. - [Renewal](https://cyberessentialspreparation.com/renewal.md): The annual cycle and what to recheck. ## Requirements (NCSC v3.3) - [Requirements hub](https://cyberessentialspreparation.com/requirements.md): Every requirement in the NCSC document, control by control, with the questions each maps to. - [Firewalls](https://cyberessentialspreparation.com/requirements/firewalls.md): To make sure that only secure and necessary network services can be accessed from the internet. - [Secure Configuration](https://cyberessentialspreparation.com/requirements/secure-configuration.md): Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role. - [Security Update Management](https://cyberessentialspreparation.com/requirements/security-update-management.md): Ensure that devices and software are not vulnerable to known security issues for which fixes are available. - [User Access Control](https://cyberessentialspreparation.com/requirements/user-access-control.md): Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role. - [Malware Protection](https://cyberessentialspreparation.com/requirements/malware-protection.md): To restrict execution of known malware and untrusted software, from causing damage or accessing data. - [Scope](https://cyberessentialspreparation.com/requirements/scope.md): BYOD, home and remote working, wireless, cloud services (cannot be excluded), sub-sets, third-party accounts and devices, software development. - [Backups](https://cyberessentialspreparation.com/requirements/backups.md): Recommended, not a technical requirement. ## Question set (Danzell v16.3) - [Question set hub](https://cyberessentialspreparation.com/questions.md): All 106 questions A1 to A8 with exact wording, answer type, a compliant answer and the automatic fails. - [A1 Your organisation](https://cyberessentialspreparation.com/questions/organisation.md): Every A1 question with its model answer. - [A2 Scope of assessment](https://cyberessentialspreparation.com/questions/scope.md): Every A2 question with its model answer. - [A3 Insurance](https://cyberessentialspreparation.com/questions/insurance.md): Every A3 question with its model answer. - [A4 Firewalls](https://cyberessentialspreparation.com/questions/firewalls.md): Every A4 question with its model answer. - [A5 Secure configuration](https://cyberessentialspreparation.com/questions/secure-configuration.md): Every A5 question with its model answer. - [A6 Security update management](https://cyberessentialspreparation.com/questions/security-update-management.md): Every A6 question with its model answer. - [A7 User access control](https://cyberessentialspreparation.com/questions/user-access-control.md): Every A7 question with its model answer. - [A8 Malware protection](https://cyberessentialspreparation.com/questions/malware-protection.md): Every A8 question with its model answer. - [Every question, one line each](https://cyberessentialspreparation.com/questions/llms.txt): Direct links to all 106 question pages. ## Cyber Essentials Plus (test specification v3.2) - [Cyber Essentials Plus](https://cyberessentialspreparation.com/cyber-essentials-plus.md): Prerequisites, the five test cases, sampling, pass and fail rules including the 2026 retest and revocation rule, and price. - [Before the audit](https://cyberessentialspreparation.com/cyber-essentials-plus/before-the-audit.md): What the assessor must verify before testing starts. - [Sample size](https://cyberessentialspreparation.com/cyber-essentials-plus/sample-size.md): How devices, servers and cloud accounts are sampled. - [Test 1: external vulnerability scan](https://cyberessentialspreparation.com/cyber-essentials-plus/test-1-external-vulnerability-scan.md): Every public IP, how services are judged. - [Test 2: authenticated patch scan](https://cyberessentialspreparation.com/cyber-essentials-plus/test-2-authenticated-patch-scan.md): Critical and high-risk fixes within 14 days on sampled devices. - [Test 3: malware protection tests](https://cyberessentialspreparation.com/cyber-essentials-plus/test-3-malware-protection-tests.md): Email and browser test files, allow-listing checks. - [Test 4: MFA on cloud services](https://cyberessentialspreparation.com/cyber-essentials-plus/test-4-mfa-on-cloud-services.md): Observed sign-ins for a user and an administrator. - [Test 5: account separation](https://cyberessentialspreparation.com/cyber-essentials-plus/test-5-account-separation.md): Standard users must be prompted for separate admin credentials. - [Pass and fail rules](https://cyberessentialspreparation.com/cyber-essentials-plus/pass-and-fail-rules.md): Any single fail fails the assessment; the marginal-deviation exception; deferrals. - [How to prepare](https://cyberessentialspreparation.com/cyber-essentials-plus/how-to-prepare.md): Remediation order that passes first time. ## Setup guides - [Microsoft 365 and Entra ID](https://cyberessentialspreparation.com/setup/microsoft-365-and-entra-id.md): Settings for all five controls, mapped to question numbers. - [Microsoft Intune](https://cyberessentialspreparation.com/setup/microsoft-intune.md): Settings for all five controls, mapped to question numbers. - [Windows 11](https://cyberessentialspreparation.com/setup/windows-11.md): Settings for all five controls, mapped to question numbers. - [macOS](https://cyberessentialspreparation.com/setup/macos.md): Settings for all five controls, mapped to question numbers. - [Google Workspace](https://cyberessentialspreparation.com/setup/google-workspace.md): Settings for all five controls, mapped to question numbers. - [iOS and iPadOS](https://cyberessentialspreparation.com/setup/ios-and-ipados.md): Settings for all five controls, mapped to question numbers. - [Android](https://cyberessentialspreparation.com/setup/android.md): Settings for all five controls, mapped to question numbers. - [Microsoft Defender for Business](https://cyberessentialspreparation.com/setup/microsoft-defender-for-business.md): Settings for all five controls, mapped to question numbers. - [Fortinet FortiGate](https://cyberessentialspreparation.com/setup/fortinet-fortigate.md): Settings for all five controls, mapped to question numbers. - [Sophos Firewall (XGS)](https://cyberessentialspreparation.com/setup/sophos-firewall.md): Settings for all five controls, mapped to question numbers. - [Cisco Meraki MX](https://cyberessentialspreparation.com/setup/cisco-meraki.md): Settings for all five controls, mapped to question numbers. - [DrayTek Vigor](https://cyberessentialspreparation.com/setup/draytek.md): Settings for all five controls, mapped to question numbers. - [Ubiquiti UniFi (Dream Machine, Cloud Gateway)](https://cyberessentialspreparation.com/setup/ubiquiti-unifi.md): Settings for all five controls, mapped to question numbers. - [WatchGuard Firebox](https://cyberessentialspreparation.com/setup/watchguard.md): Settings for all five controls, mapped to question numbers. - [Microsoft Azure (IaaS)](https://cyberessentialspreparation.com/setup/azure.md): Settings for all five controls, mapped to question numbers. - [Amazon Web Services (IaaS)](https://cyberessentialspreparation.com/setup/aws.md): Settings for all five controls, mapped to question numbers. ## Supported software - [Supported software hub](https://cyberessentialspreparation.com/supported.md): End-of-support dates for operating systems and applications, with the A6.1 verdict. One line per product at https://cyberessentialspreparation.com/supported/llms.txt. ## Tools - [Assessment checker](https://cyberessentialspreparation.com/tools/assessment-checker.md): Free 24-question readiness check weighted to the auto-fail items and the licensed-and-supported software requirement. - [Cost calculator](https://cyberessentialspreparation.com/tools/cost-calculator.md): Scheme fee band plus a fixed assessor price for a given size. - [Is it supported?](https://cyberessentialspreparation.com/tools/is-it-supported.md): Whether an operating system or application still meets A6.1 and A6.2. - [Verify a certificate](https://cyberessentialspreparation.com/tools/verify-certificate.md): How to check any organisation's certificate on the IASME register. ## Glossary - [Glossary](https://cyberessentialspreparation.com/glossary.md): Plain-English definitions of Cyber Essentials and IT security terms, each linked to the control and questions it affects. - [Glossary by category](https://cyberessentialspreparation.com/glossary/llms.txt): Every term with its one-sentence definition. - [Glossary (JSON)](https://cyberessentialspreparation.com/glossary.json): Every term with acronyms, category and definition. ## Commercial pages (Precursor Security) - [Get certified](https://cyberessentialspreparation.com/get-certified.md): Cyber Essentials from £1,500, Cyber Essentials Plus from £3,000, ex VAT, IASME fee included. - [Cost](https://cyberessentialspreparation.com/cost.md): IASME self-assessment fee bands by organisation size (£320 to £600 ex VAT), Precursor's fixed prices, Cyber Essentials Plus ranges. - [Cyber Essentials Plus cost](https://cyberessentialspreparation.com/cyber-essentials-plus/cost.md): Prices by device count with gap analysis and re-test included. - [Gap analysis](https://cyberessentialspreparation.com/gap-analysis.md): Pre-assessment review from £500, 1 to 3 days. - [How to choose a provider](https://cyberessentialspreparation.com/how-to-choose-a-cyber-essentials-provider.md): What to check before you pick a Certification Body or consultant. - [Contact](https://cyberessentialspreparation.com/contact.md): Phone, email and the quote form. - [Offers (JSON)](https://cyberessentialspreparation.com/offers.json): The three services and prices as machine-readable offers. ## Who needs it and sectors - [Who needs it](https://cyberessentialspreparation.com/who-needs-it.md): Government contracts (PPN 014), MoD, NHS, charities, schools, MSPs, insurance. - [UK government contracts](https://cyberessentialspreparation.com/who-needs-it/uk-government-contracts.md): PPN 014 under the Procurement Act 2023. - [MOD and defence suppliers](https://cyberessentialspreparation.com/who-needs-it/mod-and-defence-suppliers.md): DEFCON 658 and Def Stan 05-138. - [NHS and the DSPT](https://cyberessentialspreparation.com/who-needs-it/nhs-and-dspt.md): How Cyber Essentials fits the Data Security and Protection Toolkit. - [Cyber insurance](https://cyberessentialspreparation.com/who-needs-it/cyber-insurance.md): The insurance included with certification for eligible organisations. - [Is it worth it?](https://cyberessentialspreparation.com/who-needs-it/is-cyber-essentials-worth-it.md): Costs against benefits. - [Sectors hub](https://cyberessentialspreparation.com/sectors.md): Who mandates the certificate in each sector and what typically fails. - [Charities and not-for-profits](https://cyberessentialspreparation.com/sectors/charities.md): No regulator makes Cyber Essentials compulsory for charities. The Charity Commission's cyber crime guidance suggests it, funders can make it a grant condition,… - [Schools, academies and multi-academy trusts](https://cyberessentialspreparation.com/sectors/schools-and-academies.md): The Department for Education does not require schools in England to hold Cyber Essentials. Its cyber security standards say certification is a requirement for… - [Law firms](https://cyberessentialspreparation.com/sectors/law-firms.md): Cyber Essentials is not an SRA rule, but the Legal Aid Agency makes it a mandatory data security requirement for legal aid providers, and the Law Society… - [Accountancy and financial advisers](https://cyberessentialspreparation.com/sectors/accountancy.md): No professional body or regulator mandates Cyber Essentials for accountancy practices, but clients and insurers ask for it, and HMRC now requires multi-factor… - [Healthcare and care providers](https://cyberessentialspreparation.com/sectors/healthcare-and-care-providers.md): Organisations with access to NHS patient data complete the Data Security and Protection Toolkit, which does not require Cyber Essentials but exempts some… - [Construction and contractors](https://cyberessentialspreparation.com/sectors/construction.md): No regulator mandates Cyber Essentials in construction. It comes in through contracts: PPN 014 for relevant central government work, and supply-chain terms… - [Manufacturing](https://cyberessentialspreparation.com/sectors/manufacturing.md): Manufacturers usually meet Cyber Essentials as a contract requirement from defence, public sector or large commercial customers rather than from a regulator.… - [MSPs and IT providers](https://cyberessentialspreparation.com/sectors/msps-and-it-providers.md): No law yet requires managed service providers to hold Cyber Essentials, and the Cyber Security and Resilience Bill would regulate medium and large MSPs without… - [Recruitment](https://cyberessentialspreparation.com/sectors/recruitment.md): Recruitment agencies hold large volumes of candidate personal data. No regulator mandates Cyber Essentials, but central government and NHS buyers must ask for… - [Housing associations](https://cyberessentialspreparation.com/sectors/housing-associations.md): The Regulator of Social Housing does not mandate Cyber Essentials. Its Governance and Financial Viability Standard requires an effective risk management and… - [Local government suppliers](https://cyberessentialspreparation.com/sectors/local-government-suppliers.md): PPN 014 does not bind local authorities, but it says other public bodies may wish to apply its approach, and some council tenders ask for Cyber Essentials in… - [Defence suppliers](https://cyberessentialspreparation.com/sectors/defence-suppliers.md): Contracts carrying DEFCON 658 apply Def Stan 05-138 Issue 4, which requires Cyber Essentials at every cyber risk profile level (0 to 3) and Cyber Essentials… - [Software and SaaS companies](https://cyberessentialspreparation.com/sectors/software-and-saas.md): G-Cloud 15 makes Cyber Essentials mandatory for software and support suppliers handling personal or OFFICIAL data, and Cyber Essentials Plus mandatory for… ## Compare - [Compare hub](https://cyberessentialspreparation.com/compare.md): All comparisons. - [Cyber Essentials vs Cyber Essentials Plus](https://cyberessentialspreparation.com/compare/cyber-essentials-vs-cyber-essentials-plus.md): Self-assessed vs audited. - [Cyber Essentials vs ISO 27001](https://cyberessentialspreparation.com/compare/cyber-essentials-vs-iso-27001.md): Technical baseline vs management system. - [Cyber Essentials vs IASME Cyber Assurance](https://cyberessentialspreparation.com/compare/cyber-essentials-vs-iasme-cyber-assurance.md): Technical baseline vs governance scheme. - [Self-assessment vs using an assessor](https://cyberessentialspreparation.com/compare/self-assessment-vs-using-an-assessor.md): Direct route vs supported route. ## Research and data - [Danzell question set analysis](https://cyberessentialspreparation.com/research/danzell-question-set-analysis.md): Original counts from all 106 questions in the Danzell set by section, control, answer type, fail wording and conditional logic, with method and citation. Updated 2026-09-22. - [Data (JSON)](https://cyberessentialspreparation.com/research/danzell-question-set-analysis/data.json): Every count and key finding in one file. - [Data by section (CSV)](https://cyberessentialspreparation.com/research/danzell-question-set-analysis/data.csv): One row per section A1 to A8. - [Data by question (CSV)](https://cyberessentialspreparation.com/research/danzell-question-set-analysis/questions.csv): Derived attributes for each of the 106 questions, with page links. - [Research hub](https://cyberessentialspreparation.com/research.md): All studies and the standard they follow. ## Practical guides - [Checklists](https://cyberessentialspreparation.com/checklists.md): The Cyber Essentials, Cyber Essentials Plus and scope checklists. - [Resources](https://cyberessentialspreparation.com/resources.md): Summaries of the official NCSC and IASME documents with links to the originals. - [Blog](https://cyberessentialspreparation.com/blog.md): Assessor notes, scheme news and end-of-support alerts. RSS at https://cyberessentialspreparation.com/blog/rss.xml. - [Change log](https://cyberessentialspreparation.com/changes.md): Every scheme version, newest first. ## Official sources - [NCSC Requirements for IT Infrastructure v3.3](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf): The requirements document this site is reviewed against. - [NCSC Cyber Essentials Plus Test Specification v3.2](https://www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdf): The audit test cases. - [IASME Cyber Essentials](https://iasme.co.uk/cyber-essentials/): Scheme delivery partner, fees, certificate register. ## Optional - [Full text of the site](https://cyberessentialspreparation.com/llms-full.txt): Every page as markdown in one file, hubs first. Large: prefer the section indexes above. - [For agents](https://cyberessentialspreparation.com/for-agents.md): Fetching, caching, citation format and policy details. - [Search](https://cyberessentialspreparation.com/search): Site search; `/search?q=` returns matching pages (HTML only). - [Sitemap](https://cyberessentialspreparation.com/sitemap.xml): Every URL with lastmod. - [About](https://cyberessentialspreparation.com/about.md): Who runs the site and the editorial policy.