A3.1: Is your organisation eligible for the included cyber insurance?
Is your head office domiciled in the UK or Crown Dependencies and is your gross annual turnover less than £20m?
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A3.1 if your head office is domiciled in the UK or the Crown Dependencies and your gross annual turnover is less than £20 million. A Yes makes you eligible for the cyber liability insurance included with certification at no extra cost. A No has no effect on the assessment; you simply cannot opt in at A3.2.
Is A3.1 an automatic fail?
No. A3.1 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- This question relates to the eligibility of your organisation for the included cyber insurance
- Requirement enforced
- Not a technical requirement. The included cyber liability insurance is an IASME benefit for eligible UK organisations certifying their whole organisation.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
What does A3.1 ask?
A3.1 asks: “Is your head office domiciled in the UK or Crown Dependencies and is your gross annual turnover less than £20m?”
A3.1 asks whether your head office is domiciled in the UK or Crown Dependencies and whether your gross annual turnover is less than £20m. The guidance says the question relates to your organisation's eligibility for the included cyber insurance.
IASME's introduction to the insurance section says the insurance is free of charge, that you can opt out, that opting in or out does not change the price of the assessment, and that the answers do not affect the result of your Cyber Essentials assessment. See Cyber Essentials and cyber insurance.
How should you answer A3.1?
A3.1 has no single compliant answer. Answer it accurately for your organisation today; this is what each answer means.
- Answer Yes if both conditions are true: head office in the UK or the Crown Dependencies, and gross annual turnover under £20 million.
- Answer No if either is false. The assessment is unaffected; only the insurance offer falls away.
- Use the turnover of the organisation being certified, including the entities listed in A1.6.1.
What mistakes do applicants make with A3.1?
A common mistake with A3.1: answering Yes when group turnover across the entities in A1.6.1 is over £20 million.
- Assuming the insurance replaces an existing policy without reading its terms.
- Thinking a No will affect the assessment result; it does not.
- Not having the board-level declaration signed, which IASME says can delay the insurance policy being issued.
How do you get A3.1 right?
Work through these steps before you enter A3.1 in the portal:
- Check the head office location and the gross annual turnover across all entities in scope.
- Answer Yes only if both conditions are met; a No has no effect on the assessment.
How do assessors check A3.1?
What evidence should you keep for A3.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A3.1:
- The latest accounts showing turnover, and the head office address.
Where to go next
- Cyber Essentials and cyber insuranceWhat the included policy means
- Cyber insuranceGlossary
- What Cyber Essentials costsThe insurance is included at no extra cost
- All A3 questionsInsurance
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A3 questions
- A3.2A3.2Opt-in / opt-outIf you have answered "yes" to the last question, then your organisation is eligible for the included cyber insurance if you gain certification. Would you like to opt in for the included cyber insuran…Opt-in / opt-out
- A3.3A3.3NotesWhat is the organisation email contact for the insurance documents? You only need to answer this question if you are taking the insurance.Notes
Frequently asked questions
A3.1 in the 2026 Danzell Cyber Essentials question set asks: "Is your head office domiciled in the UK or Crown Dependencies and is your gross annual turnover less than £20m?" It is a Yes/No question.
Answer Yes to A3.1 if your head office is domiciled in the UK or the Crown Dependencies and your gross annual turnover is less than £20 million. A Yes makes you eligible for the cyber liability insurance included with certification at no extra cost. A No has no effect on the assessment; you simply cannot opt in at A3.2.
No. A3.1 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
Organisations with a head office domiciled in the UK or the Crown Dependencies and gross annual turnover under £20 million, according to A3.1 in the Danzell question set.
No. IASME's guidance says there is no additional cost for the insurance and opting in or out does not change the price of the assessment package.
No. IASME's introduction to the insurance section says the answers will not affect the result of your assessment.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh