# Cyber Essentials question set (Danzell v16.3)

> Every question in the IASME Danzell Cyber Essentials self-assessment, in force for accounts opened from 2026-04-27. 106 questions in sections A1 to A8. Each page gives the exact wording, the answer type, the IASME guidance, a compliant answer, the evidence an assessor expects and whether the question is an automatic fail.

Question numbers are cited exactly as IASME prints them (A6.4, A7.16). Sections A4 to A8 test the five technical controls in NCSC Requirements for IT Infrastructure v3.3. The hub is https://cyberessentialspreparation.com/questions and the site index is https://cyberessentialspreparation.com/llms.txt.

## A1 Your organisation
- [A1 section overview](https://cyberessentialspreparation.com/questions/organisation.md): What section A1 tests and how its 23 questions fit together.
- [A1.1: organisation name](https://cyberessentialspreparation.com/questions/organisation/a1-1.md): What is your organisation's name? Answer type: notes.
- [A1.2: organisation type](https://cyberessentialspreparation.com/questions/organisation/a1-2.md): What type of organisation are you? Answer type: multiple choice.
- [A1.3: number of employees](https://cyberessentialspreparation.com/questions/organisation/a1-3.md): How many employees are there in the organisation? Answer type: notes.
- [A1.4: registration number](https://cyberessentialspreparation.com/questions/organisation/a1-4.md): What is your organisation's registration number? Answer type: notes.
- [A1.5: registered address](https://cyberessentialspreparation.com/questions/organisation/a1-5.md): What is your organisation's registered address? Answer type: notes.
- [A1.5.1: operational addresses](https://cyberessentialspreparation.com/questions/organisation/a1-5-1.md): Please provide the operational addresses, if different to your registered address. Answer type: notes.
- [A1.6: more than one legal entity](https://cyberessentialspreparation.com/questions/organisation/a1-6.md): Do you have more than one legal entity, including subsidiaries, within the scope of this assessment? Answer type: yes/no.
- [A1.6.1: additional legal entities](https://cyberessentialspreparation.com/questions/organisation/a1-6-1.md): Please provide the name, company number and registered address of any additional legal entities that are included. Answer type: notes, multiple choice (type), multiple choice (organisation occupation).
- [A1.7: main business](https://cyberessentialspreparation.com/questions/organisation/a1-7.md): What is your main business? Answer type: multiple choice notes.
- [A1.8: website address](https://cyberessentialspreparation.com/questions/organisation/a1-8.md): What is your website address? Answer type: notes.
- [A1.9: renewal or first application](https://cyberessentialspreparation.com/questions/organisation/a1-9.md): Is this application a renewal of an existing certification or is it the first time you have applied for certification? Answer type: select either "renewal" or "first time application".
- [A1.10: reasons for certifying](https://cyberessentialspreparation.com/questions/organisation/a1-10.md): What are the two main reasons for applying for certification? Answer type: multiple choice + notes field: 
"required for a commercial contract", "required for government contract", "to give confidence to our customers", "required by insurer", "required by regulator", "required for a grant", "to generally improve our security", "other".
- [A1.10.1: contracting organisation](https://cyberessentialspreparation.com/questions/organisation/a1-10-1.md): Who is the commercial contracting organisation? Answer type: notes.
- [A1.10.2: government contract details](https://cyberessentialspreparation.com/questions/organisation/a1-10-2.md): Who is the government contracting organisation and the contract number? Answer type: notes.
- [A1.10.3: grant authority](https://cyberessentialspreparation.com/questions/organisation/a1-10-3.md): Who is the grant authority? Answer type: notes.
- [A1.10.4: regulator](https://cyberessentialspreparation.com/questions/organisation/a1-10-4.md): Who is the regulator? Answer type: notes.
- [A1.10.5: other reasons for applying](https://cyberessentialspreparation.com/questions/organisation/a1-10-5.md): What are the reasons you have applied for the certification which you described as "other"? Answer type: notes.
- [A1.11: reading the requirements document](https://cyberessentialspreparation.com/questions/organisation/a1-11.md): Have you read the 'Cyber Essentials Requirements for IT Infrastructure' document? Answer type: yes/no.
- [A1.12: NCSC Cyber Advisor](https://cyberessentialspreparation.com/questions/organisation/a1-12.md): Have you spoken to an assured NCSC Cyber Advisor to help with your application? Answer type: yes/no.
- [A1.13: breach contact consent](https://cyberessentialspreparation.com/questions/organisation/a1-13.md): Can IASME and their expert partners contact you if you experience a cyber breach? Answer type: yes/no.
- [A1.14: where you heard about it](https://cyberessentialspreparation.com/questions/organisation/a1-14.md): Where did you hear about Cyber Essentials? Answer type: multiple choice

-contractual requirement
-government contractual requirement
-tender
-customer request
-certification body
-cyber advisor
-cyber resilience centre
-national cyber security centre (ncsc)
-iasme
-internet search
-social media
-cyber action toolkit
-other.
- [A1.15: research contact consent](https://cyberessentialspreparation.com/questions/organisation/a1-15.md): Can IASME contact you for research purposes? Answer type: yes/no.
- [A1.16: NCSC Early Warning service](https://cyberessentialspreparation.com/questions/organisation/a1-16.md): Have you signed up to the NCSC’s free Early Warning service? Answer type: yes/no.

## A2 Scope of assessment
- [A2 section overview](https://cyberessentialspreparation.com/questions/scope.md): What section A2 tests and how its 18 questions fit together.
- [A2.1: whole or partial scope](https://cyberessentialspreparation.com/questions/scope/a2-1.md): Is this assessment for your whole organisation or only a part of it? Answer type: multiple choice:
whole organisation
partial organisation.
- [A2.2: partial scope description](https://cyberessentialspreparation.com/questions/scope/a2-2.md): If you are certifying part of your organisation, please write a detailed description of the scope here. Answer type: notes.
- [A2.2.1: networks excluded by sub-set](https://cyberessentialspreparation.com/questions/scope/a2-2-1.md): Please provide a description of any networks that have been excluded from the assessment by creating a sub-set. Answer type: notes.
- [A2.2.2: how sub-sets are created](https://cyberessentialspreparation.com/questions/scope/a2-2-2.md): Where one or more sub-sets have been created, please describe how this has been achieved. Answer type: notes.
- [A2.3: networks at company locations](https://cyberessentialspreparation.com/questions/scope/a2-3.md): Are the networks included in the scope of this assessment being used at the company locations you provided earlier? Answer type: notes.
- [A2.3.1: internet connection per site](https://cyberessentialspreparation.com/questions/scope/a2-3-1.md): Do you have an internet connection for each site in your organisation? Answer type: yes/no.
- [A2.3.2: how sites are connected](https://cyberessentialspreparation.com/questions/scope/a2-3-2.md): If no, please describe the way that your sites are connected. Answer type: notes.
- [A2.4: networks in scope](https://cyberessentialspreparation.com/questions/scope/a2-4.md): Please provide a list of networks that will be in scope for this assessment. Answer type: notes.
- [A2.4.1: number of home workers](https://cyberessentialspreparation.com/questions/scope/a2-4-1.md): How many staff are home or remote workers? Answer type: notes.
- [A2.4.2: how home workers connect](https://cyberessentialspreparation.com/questions/scope/a2-4-2.md): How are home/remote workers connecting to your organisational data and services? Answer type: notes.
- [A2.5: firewalls and routers in scope](https://cyberessentialspreparation.com/questions/scope/a2-5.md): Please provide a list of network equipment that will be in scope for this assessment (including firewalls and routers). You must include make, model and quantity of each device… Answer type: notes.
- [A2.5.1: equipment creating sub-sets](https://cyberessentialspreparation.com/questions/scope/a2-5-1.md): If you are certifying as partial organisation, please list the equipment used to create any sub-sets. Answer type: notes.
- [A2.6: laptops and desktops in scope](https://cyberessentialspreparation.com/questions/scope/a2-6.md): Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment. Please Note: You must include make and… Answer type: notes.
- [A2.6.1: thin clients in scope](https://cyberessentialspreparation.com/questions/scope/a2-6-1.md): Please list the quantity of thin clients within the scope of this assessment. Please include make and operating systems. Answer type: notes.
- [A2.7: servers and hypervisors in scope](https://cyberessentialspreparation.com/questions/scope/a2-7.md): Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system. Answer type: notes.
- [A2.8: tablets and phones in scope](https://cyberessentialspreparation.com/questions/scope/a2-8.md): Please list the quantities of tablets and mobile devices within the scope of this assessment. Answer type: notes.
- [A2.9: cloud services list](https://cyberessentialspreparation.com/questions/scope/a2-9.md): Please list all the cloud services that are in use by your organisation and provided by a third party. Please note that cloud services cannot be excluded from the scope of Cyber… Answer type: notes.
- [A2.10: person responsible for IT](https://cyberessentialspreparation.com/questions/scope/a2-10.md): Please provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment. Answer type: notes.

## A3 Insurance
- [A3 section overview](https://cyberessentialspreparation.com/questions/insurance.md): What section A3 tests and how its 3 questions fit together.
- [A3.1: insurance eligibility](https://cyberessentialspreparation.com/questions/insurance/a3-1.md): Is your head office domiciled in the UK or Crown Dependencies and is your gross annual turnover less than £20m? Answer type: yes/no.
- [A3.2: insurance opt-in](https://cyberessentialspreparation.com/questions/insurance/a3-2.md): If you have answered "yes" to the last question, then your organisation is eligible for the included cyber insurance if you gain certification. Would you like to opt in for the… Answer type: opt-in/opt-out.
- [A3.3: insurance contact email](https://cyberessentialspreparation.com/questions/insurance/a3-3.md): What is the organisation email contact for the insurance documents? You only need to answer this question if you are taking the insurance. Answer type: notes.

## A4 Firewalls
- [A4 section overview](https://cyberessentialspreparation.com/questions/firewalls.md): What section A4 tests and how its 14 questions fit together.
- [A4.1: boundary firewalls](https://cyberessentialspreparation.com/questions/firewalls/a4-1.md): Do you have firewalls at the boundaries between your organisation’s internal networks, laptops, desktops, servers and the internet? Answer type: yes/no.
- [A4.1.1: software firewalls enabled](https://cyberessentialspreparation.com/questions/firewalls/a4-1-1.md): Do you have software firewalls enabled on all of your computers, laptops and servers? Answer type: yes/no.
- [A4.1.2: no built-in software firewall](https://cyberessentialspreparation.com/questions/firewalls/a4-1-2.md): If you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating… Answer type: notes.
- [A4.2: default firewall password](https://cyberessentialspreparation.com/questions/firewalls/a4-2.md): When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary… Answer type: yes/no.
- [A4.2.1: changing the firewall password](https://cyberessentialspreparation.com/questions/firewalls/a4-2-1.md): Please describe the process for changing your firewall password. Home routers not supplied by your organisation are not included in this requirement. Answer type: notes.
- [A4.3: firewall password options](https://cyberessentialspreparation.com/questions/firewalls/a4-3.md): How is your firewall password configured? Please select the option being used: A. Multi-factor authentication, with a minimum password length 8 characters and no maximum length B.… Answer type: options a, b, c, d or e.

must be able to select all 5 options

d is now passwordless - requires notes field

e is now ‘none of the above’, requires notes field.
- [A4.4: compromised firewall password](https://cyberessentialspreparation.com/questions/firewalls/a4-4.md): Do you change your firewall password when you know or suspect it has been compromised? Answer type: yes/no.
- [A4.5: firewall management process](https://cyberessentialspreparation.com/questions/firewalls/a4-5.md): Do you have a process to manage your firewall? Answer type: yes/no.
- [A4.6: annual firewall rule review](https://cyberessentialspreparation.com/questions/firewalls/a4-6.md): Have you reviewed your firewall rules in the last 12 months? Please describe your review process. Answer type: notes.
- [A4.7: unauthenticated inbound connections](https://cyberessentialspreparation.com/questions/firewalls/a4-7.md): Is your firewall configured to allow unauthenticated inbound connections? Answer type: yes/no.
- [A4.8: approving inbound rules](https://cyberessentialspreparation.com/questions/firewalls/a4-8.md): Please describe how you approve and document your allowed inbound connections. Answer type: notes.
- [A4.9: firewall admin over the internet](https://cyberessentialspreparation.com/questions/firewalls/a4-9.md): Are your boundary firewalls configured to allow access to their configuration settings over the internet? Answer type: yes/no.
- [A4.10: business need for remote admin](https://cyberessentialspreparation.com/questions/firewalls/a4-10.md): If you answered yes in question A4.9, is there a documented business requirement for this access? Answer type: yes/no.
- [A4.11: MFA or allow list on firewall admin](https://cyberessentialspreparation.com/questions/firewalls/a4-11.md): If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined… Answer type: notes.

## A5 Secure configuration
- [A5 section overview](https://cyberessentialspreparation.com/questions/secure-configuration.md): What section A5 tests and how its 10 questions fit together.
- [A5.1: removing unused software](https://cyberessentialspreparation.com/questions/secure-configuration/a5-1.md): Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?… Answer type: notes.
- [A5.2: removing unused accounts](https://cyberessentialspreparation.com/questions/secure-configuration/a5-2.md): Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course… Answer type: yes/no.
- [A5.3: changing default passwords](https://cyberessentialspreparation.com/questions/secure-configuration/a5-3.md): Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow… Answer type: yes/no.
- [A5.4: externally hosted services](https://cyberessentialspreparation.com/questions/secure-configuration/a5-4.md): Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet? Answer type: yes/no.
- [A5.5: external service authentication](https://cyberessentialspreparation.com/questions/secure-configuration/a5-5.md): If yes to question A5.4, which authentication option do you use? A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length B. Automatic… Answer type: options a, b, c, d or e
 
option d is now ‘passwordless’ - requires notes field
please note additional option e has been added and requires a notes field..
- [A5.6: compromised external passwords](https://cyberessentialspreparation.com/questions/secure-configuration/a5-6.md): Describe the process in place for changing passwords on your external services when you believe they have been compromised. Answer type: notes.
- [A5.7: brute-force protection](https://cyberessentialspreparation.com/questions/secure-configuration/a5-7.md): When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks? A. Throttling the rate of attempts B. Locking… Answer type: options a, b or c

option c requires a 'notes field'.
- [A5.8: auto-run disabled](https://cyberessentialspreparation.com/questions/secure-configuration/a5-8.md): Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation? Answer type: yes/no.
- [A5.9: device locking](https://cyberessentialspreparation.com/questions/secure-configuration/a5-9.md): When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? Answer type: yes/no.
- [A5.10: device unlock method](https://cyberessentialspreparation.com/questions/secure-configuration/a5-10.md): Which method do you use to unlock the devices? Answer type: notes.

## A6 Security update management
- [A6 section overview](https://cyberessentialspreparation.com/questions/security-update-management.md): What section A6 tests and how its 16 questions fit together.
- [A6.1: supported operating systems](https://cyberessentialspreparation.com/questions/security-update-management/a6-1.md): Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in… Answer type: yes/no.
- [A6.2: supported software](https://cyberessentialspreparation.com/questions/security-update-management/a6-2.md): Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems? Answer type: yes/no.
- [A6.2.1: browser versions](https://cyberessentialspreparation.com/questions/security-update-management/a6-2-1.md): Please list your internet browser(s). The version is required. Answer type: notes.
- [A6.2.2: malware protection versions](https://cyberessentialspreparation.com/questions/security-update-management/a6-2-2.md): Please list your malware protection software The version is required. Answer type: notes.
- [A6.2.3: email application versions](https://cyberessentialspreparation.com/questions/security-update-management/a6-2-3.md): Please list your email applications installed on end user devices and servers. The version is required. Answer type: notes.
- [A6.2.4: office application versions](https://cyberessentialspreparation.com/questions/security-update-management/a6-2-4.md): Please list all office applications that are used to create organisational data. The version is required. Answer type: notes.
- [A6.3: unlicensed or unsupported software](https://cyberessentialspreparation.com/questions/security-update-management/a6-3.md): Are any of the in-scope software or cloud services unlicensed or unsupported? Answer type: yes/no.
- [A6.3.1: listing unsupported software](https://cyberessentialspreparation.com/questions/security-update-management/a6-3-1.md): If yes to A6.3, please list the unsupported or unlicensed software or cloud services. Answer type: notes.
- [A6.4: 14-day OS and firmware updates](https://cyberessentialspreparation.com/questions/security-update-management/a6-4.md): Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? Answer type: yes/no. Automatic fail on a No.
- [A6.4.1: OS automatic updates](https://cyberessentialspreparation.com/questions/security-update-management/a6-4-1.md): Are all updates applied for operating systems by enabling auto updates? Answer type: yes/no.
- [A6.4.2: OS updates without auto-update](https://cyberessentialspreparation.com/questions/security-update-management/a6-4-2.md): Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and… Answer type: notes.
- [A6.5: 14-day application updates](https://cyberessentialspreparation.com/questions/security-update-management/a6-5.md): Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release? Answer type: yes/no. Automatic fail on a No.
- [A6.5.1: application automatic updates](https://cyberessentialspreparation.com/questions/security-update-management/a6-5-1.md): Are all updates applied on your applications by enabling auto updates? Answer type: yes/no.
- [A6.5.2: app updates without auto-update](https://cyberessentialspreparation.com/questions/security-update-management/a6-5-2.md): Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release? Answer type: notes.
- [A6.6: removing unsupported software](https://cyberessentialspreparation.com/questions/security-update-management/a6-6.md): Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems? Answer type: yes/no.
- [A6.7: isolating unsupported software](https://cyberessentialspreparation.com/questions/security-update-management/a6-7.md): Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this. Answer type: notes.

## A7 User access control
- [A7 section overview](https://cyberessentialspreparation.com/questions/user-access-control.md): What section A7 tests and how its 17 questions fit together.
- [A7.1: approving new accounts](https://cyberessentialspreparation.com/questions/user-access-control/a7-1.md): Are your users only provided with user accounts after a process has been followed to approve their creation? Describe the process. Answer type: notes.
- [A7.2: unique credentials](https://cyberessentialspreparation.com/questions/user-access-control/a7-2.md): Are all your user and administrative accounts accessed by entering unique credentials? Answer type: yes/no.
- [A7.3: removing leavers' accounts](https://cyberessentialspreparation.com/questions/user-access-control/a7-3.md): How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? Answer type: notes.
- [A7.4: least privilege](https://cyberessentialspreparation.com/questions/user-access-control/a7-4.md): Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this? Answer type: notes.
- [A7.5: granting admin access](https://cyberessentialspreparation.com/questions/user-access-control/a7-5.md): Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process? Answer type: notes.
- [A7.6: separate admin accounts](https://cyberessentialspreparation.com/questions/user-access-control/a7-6.md): How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies… Answer type: notes.
- [A7.7: no admin accounts for daily tasks](https://cyberessentialspreparation.com/questions/user-access-control/a7-7.md): How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email? Answer type: notes.
- [A7.8: tracking admin accounts](https://cyberessentialspreparation.com/questions/user-access-control/a7-8.md): Do you formally track which users have administrator accounts in your organisation? Answer type: yes/no.
- [A7.9: reviewing admin access](https://cyberessentialspreparation.com/questions/user-access-control/a7-9.md): Do you review who should have administrative access on a regular basis? Answer type: yes/no.
- [A7.10: brute-force protection for passwords](https://cyberessentialspreparation.com/questions/user-access-control/a7-10.md): Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks? Answer type: notes.
- [A7.11: password quality controls](https://cyberessentialspreparation.com/questions/user-access-control/a7-11.md): Which technical controls are used to manage the quality of your passwords within your organisation? Answer type: notes.
- [A7.12: encouraging strong passwords](https://cyberessentialspreparation.com/questions/user-access-control/a7-12.md): Please explain how you encourage people to use unique and strong passwords. Answer type: notes.
- [A7.13: compromised password process](https://cyberessentialspreparation.com/questions/user-access-control/a7-13.md): Do you have a process for when you believe the passwords or accounts have been compromised? Answer type: yes/no.
- [A7.14: MFA available on cloud services](https://cyberessentialspreparation.com/questions/user-access-control/a7-14.md): Do all of your cloud services have multi-factor authentication (MFA) available as part of the service? A cloud service is an on-demand, scalable service, hosted on shared… Answer type: yes/no.
- [A7.15: cloud services without MFA](https://cyberessentialspreparation.com/questions/user-access-control/a7-15.md): If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA. Answer type: notes. Automatic fail if a cloud service listed there does offer MFA.
- [A7.16: MFA for cloud administrators](https://cyberessentialspreparation.com/questions/user-access-control/a7-16.md): Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? Answer type: yes/no. Automatic fail on a No.
- [A7.17: MFA for all cloud users](https://cyberessentialspreparation.com/questions/user-access-control/a7-17.md): Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? Answer type: yes/no. Automatic fail on a No.

## A8 Malware protection
- [A8 section overview](https://cyberessentialspreparation.com/questions/malware-protection.md): What section A8 tests and how its 5 questions fit together.
- [A8.1: anti-malware or allow listing](https://cyberessentialspreparation.com/questions/malware-protection/a8-1.md): Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either: A - Having anti-malware software installed and/or B - Limiting installation… Answer type: multiple choice

applicants need to have the option to select both, and answer the associated questions. 

option c requires a 'notes field'.
- [A8.2: anti-malware updates](https://cyberessentialspreparation.com/questions/malware-protection/a8-2.md): If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on… Answer type: yes/no.
- [A8.3: web protection](https://cyberessentialspreparation.com/questions/malware-protection/a8-3.md): If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites? Answer type: yes/no.
- [A8.4: blocking unsigned apps](https://cyberessentialspreparation.com/questions/malware-protection/a8-4.md): If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications? Answer type: yes/no.
- [A8.5: approved application list](https://cyberessentialspreparation.com/questions/malware-protection/a8-5.md): If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation… Answer type: yes/no.