Cyber Essentials requirements (v3.3, April 2026): the full list

Firewalls, secure configuration, security update management, user access control and malware protection. The NCSC organises every requirement under these five technical control themes in the Requirements for IT Infrastructure document, currently v3.3 (April 2026).

Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026, assessed through the Danzell question set (v16.3) for assessment accounts opened from 27 April 2026. This site is written against that version and flags any earlier wording.

All devices and software in scope that can accept incoming network connections from internet-connected devices, can establish outbound connections to devices via the internet, or control the flow of data between any of those devices and the internet. That includes end user devices, servers, network equipment, IaaS, PaaS and SaaS. A scope without end user devices is not acceptable and cloud services cannot be excluded.

Under the 2026 Danzell question set, four questions fail automatically on a No answer: A6.4 and A6.5 (critical or high-risk updates within 14 days for operating systems and applications) and A7.16 and A7.17 (MFA on all cloud administrators and all cloud users). A7.15 fails automatically if a cloud service listed there as having no MFA option does offer MFA. A6.3 and A6.6 (unsupported software) are not labelled automatic fails, but a non-compliant answer means the licensed-and-supported requirement is not met.

No. Section C of the requirements says backing up your data is not a technical requirement of Cyber Essentials, though the NCSC highly recommends it. No question in the Danzell set assesses backups.

Six items are listed in v3.3: a definition for cloud services, passwordless authentication updated to include FIDO2, a definitive statement that cloud services cannot be excluded from scope, the Software Security Code of Practice referenced in software development, scope criteria no longer referring to untrusted connections, and the importance of backups emphasised. IASME separately introduced the new auto-fail marking.

You get one free resubmission if you are quick. IASME's terms (clause 2.6) give one free further assessment if you resubmit within 48 hours of the fail notice. Use the assessor's comments on the non-compliant answers to fix the controls or the wording, then resubmit. A later attempt is charged as a new application, so have the fixes ready before you submit.

Twelve months from the date of issue, under clause 2.4 of IASME's terms. There is no extension: you renew by completing a new assessment against the question set current at the time. IASME's terms also give you six months from receiving the questionnaire to submit it (clause 2.2), after which it will not be assessed and the fee is not refunded.