A1.10.4: Which regulator requires certification?
Who is the regulator?
Source: IASME Cyber Essentials Danzell question set v16.3
A1.10.4 appears when you chose 'required by regulator' in A1.10. Name the regulator that expects or requires Cyber Essentials, for example a sector regulator. It is recorded for IASME's research and does not affect marking. Be specific: the regulator's name, and the rule or standard that asks for it if you know it.
Is A1.10.4 an automatic fail?
No. A1.10.4 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please provide details of the regulator.
- Requirement enforced
- Section A1 collects the details that appear on the certificate and shape which later questions are shown.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
What does A1.10.4 ask?
A1.10.4 asks: “Who is the regulator?”
A1.10.4 asks who the regulator is. The guidance asks for details of the regulator.
Some sector frameworks recognise Cyber Essentials as evidence for part of their own requirements; health and care organisations will know the Data Security and Protection Toolkit, covered in NHS and DSPT.
What should you write in the notes field for A1.10.4?
Write two to four specific sentences for A1.10.4: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Regulator name], under [rule, licence condition or standard, if known]
What mistakes do applicants make with A1.10.4?
A common mistake with A1.10.4: naming a customer or insurer rather than a regulator; those have their own options in A1.10.
- Leaving the field blank after selecting the regulator reason.
- Giving an acronym the reader may not recognise; spell it out.
- Treating the answer as marked.
How do you get A1.10.4 right?
Work through these steps before you enter A1.10.4 in the portal:
- Name the regulator in full and, if you know it, the rule or standard that asks for Cyber Essentials.
How do assessors check A1.10.4?
Where to go next
Other A1 questions
- A1.10.2A1.10.2NotesWho is the government contracting organisation and the contract number?Notes
- A1.10.3A1.10.3NotesWho is the grant authority?Notes
- A1.10.5A1.10.5NotesWhat are the reasons you have applied for the certification which you described as "other"?Notes
- A1.11A1.11Yes/NoHave you read the 'Cyber Essentials Requirements for IT Infrastructure' document?Yes/No
Frequently asked questions
A1.10.4 in the 2026 Danzell Cyber Essentials question set asks: "Who is the regulator?" It is a notes question, answered in free text.
A1.10.4 appears when you chose 'required by regulator' in A1.10. Name the regulator that expects or requires Cyber Essentials, for example a sector regulator. It is recorded for IASME's research and does not affect marking. Be specific: the regulator's name, and the rule or standard that asks for it if you know it.
No. A1.10.4 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
Not in general. It is required by many contracts and some funding and sector schemes. If a regulator asks for it in your sector, name the regulator here.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh