A1.11: Have you read the Cyber Essentials Requirements for IT Infrastructure?
Have you read the 'Cyber Essentials Requirements for IT Infrastructure' document?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A1.11 once someone responsible for the application has read the NCSC's Cyber Essentials Requirements for IT Infrastructure, currently v3.3 (April 2026). It is the document every answer is marked against. Reading it first saves time: the password, MFA, 14-day update and scope rules are all defined there, not in the question set.
Is A1.11 an automatic fail?
No. A1.11 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Document is available on the NCSC Cyber Essentials website and should be read before completing this question set.
- Requirement enforced
- Section A1 collects the details that appear on the certificate and shape which later questions are shown.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
What does A1.11 ask?
A1.11 asks: “Have you read the 'Cyber Essentials Requirements for IT Infrastructure' document?”
A1.11 asks whether you have read the 'Cyber Essentials Requirements for IT Infrastructure' document. The guidance says it is available on the NCSC Cyber Essentials website and should be read before completing the question set.
The current version is v3.3, April 2026. Its six changes are a definition of 'cloud services', an updated definition of passwordless authentication that includes FIDO2, a definitive statement that cloud services cannot be excluded from scope, the Software Security Code of Practice in the software development section, scope criteria that no longer refer to 'untrusted connections', and more emphasis on backing up data. See our plain-English guide to the requirements and the summary of what changed in 2026.
What must be true to answer Yes to A1.11?
You can answer Yes to A1.11 only when all of the following are true today, across every device, user and cloud service in scope.
- Someone who completes or signs off the answers has read v3.3, not an older version such as v3.2.
- They know where the key thresholds come from: 14 days for critical and high-risk updates, 12-character passwords (or 8 with MFA or a deny list), no more than 10 guesses in 5 minutes, 6-character device unlock PINs.
- They have read the scope section, including BYOD, home working, cloud services and third-party accounts.
- The person signing the final attestation understands what they are confirming.
What mistakes do applicants make with A1.11?
A common mistake with A1.11: answering Yes having read an older version, then answering password or scope questions against outdated rules.
- Relying on an MSP who has read it while the person signing off has not.
- Skipping the scope section, which is where most returned applications start.
- Treating the question set guidance as a full statement of the requirements; it quotes only parts of v3.3.
How do you get A1.11 right?
Work through these steps before you enter A1.11 in the portal:
- Download Requirements for IT Infrastructure v3.3 from the NCSC website.
- Have the person completing the answers and the person signing the attestation read it, starting with the scope section.
- Re-check your password, MFA, 14-day and scope answers against the thresholds it defines.
How do assessors check A1.11?
What evidence should you keep for A1.11?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A1.11:
- A copy of Requirements for IT Infrastructure v3.3 and a note of who read it and when.
Where to go next
- What changed in 2026Danzell and v3.3
- Requirements overviewThe five controls in plain English
- NCSC requirements v3.3The document summarised
- How to get certifiedThe application, step by step
- What Cyber Essentials costsIASME fee bands and assessor prices
- All A1 questionsYour organisation
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A1 questions
- A1.10.4A1.10.4NotesWho is the regulator?Notes
- A1.10.5A1.10.5NotesWhat are the reasons you have applied for the certification which you described as "other"?Notes
- A1.12A1.12Yes/NoHave you spoken to an assured NCSC Cyber Advisor to help with your application?Yes/No
- A1.13A1.13Yes/NoCan IASME and their expert partners contact you if you experience a cyber breach?Yes/No
Frequently asked questions
A1.11 in the 2026 Danzell Cyber Essentials question set asks: "Have you read the 'Cyber Essentials Requirements for IT Infrastructure' document?" It is a Yes/No question.
Answer Yes to A1.11 once someone responsible for the application has read the NCSC's Cyber Essentials Requirements for IT Infrastructure, currently v3.3 (April 2026). It is the document every answer is marked against. Reading it first saves time: the password, MFA, 14-day update and scope rules are all defined there, not in the question set.
No. A1.11 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
Requirements for IT Infrastructure v3.3, published by the NCSC in April 2026. The Danzell question set v16.3 assesses against it.
No. It is not an automatic fail and not marked against a requirement. But reading the document first is the fastest way to answer the technical sections correctly.
On the NCSC's Cyber Essentials pages. This site also summarises each of the five controls and the scope rules in plain English.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh