A1.3: How many employees does your organisation have?
How many employees are there in the organisation?
Source: IASME Cyber Essentials Danzell question set v16.3
A1.3 needs the total number of people working for your organisation across every legal entity in scope. IASME's guidance says to include volunteers, agency workers, contractors and anyone else with access to your organisational data. Give a single current headcount, not full-time equivalents, and make sure it is consistent with the device and user counts in section A2.
Is A1.3 an automatic fail?
No. A1.3 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please provide the number of people who are working for your organisation, including all legal entities. This would include volunteers, agency workers, contractors and others who have access to your organisational data.
- Requirement enforced
- Section A1 collects the details that appear on the certificate and shape which later questions are shown.
- Outcome if non-compliant
- Not marked against a requirement; inaccurate details may be returned for correction
What does A1.3 ask?
A1.3 asks: “How many employees are there in the organisation?”
A1.3 asks how many employees there are in the organisation. The guidance widens 'employees' to everyone who works for you and has access to organisational data: staff, volunteers, agency workers and contractors, across all the legal entities included in the assessment.
The headcount matters in two ways. It sets the size band used for the IASME assessment fee (see what Cyber Essentials costs), and the assessor uses it as a sense check against the devices in A2.6 and A2.8 and the accounts implied by section A7.
What should you write in the notes field for A1.3?
Write two to four specific sentences for A1.3: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Number] people: [n] employees, [n] contractors and agency workers, [n] volunteers, across [list of legal entities from A1.1 and A1.6.1]. Count taken from [HR system or payroll] on [date].
What mistakes do applicants make with A1.3?
A common mistake with A1.3: counting only payroll staff and leaving out contractors, volunteers and agency workers who hold accounts.
- Giving full-time equivalents, which understates the number of people and accounts.
- A headcount far higher than the number of user devices declared in A2, with no explanation of shared or BYOD devices.
- Counting only the primary entity when A1.6.1 lists other entities in scope.
How do you get A1.3 right?
Work through these steps before you enter A1.3 in the portal:
- Pull a current headcount from payroll or your HR system.
- Add contractors, agency workers and volunteers who have accounts or access to organisational data.
- Include people in every entity listed in A1.6.1.
- Compare the total with the user devices in A2.6 and A2.8; if they differ widely, explain shared or BYOD devices in the A2 notes.
How do assessors check A1.3?
What evidence should you keep for A1.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A1.3:
- A dated headcount from payroll or HR, with contractors, agency workers and volunteers added.
Where to go next
Other A1 questions
Frequently asked questions
A1.3 in the 2026 Danzell Cyber Essentials question set asks: "How many employees are there in the organisation?" It is a notes question, answered in free text.
A1.3 needs the total number of people working for your organisation across every legal entity in scope. IASME's guidance says to include volunteers, agency workers, contractors and anyone else with access to your organisational data. Give a single current headcount, not full-time equivalents, and make sure it is consistent with the device and user counts in section A2.
No. A1.3 records information about your organisation and is not marked against a technical requirement, so no answer to it fails the assessment. Inaccurate or contradictory details may be returned by the assessor for correction.
Yes. IASME's A1.3 guidance says to include volunteers, agency workers, contractors and others who have access to your organisational data.
The IASME assessment fee is set by organisation size band, so the number you give feeds the fee. Check the current bands on the IASME website before you apply.
No. Give the number of people. Every person with access to organisational data has at least one account and usually a device, and those are what the assessment covers.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh