# Cyber Essentials requirements (NCSC v3.3)

> The five technical controls and the scope rules in NCSC Requirements for IT Infrastructure v3.3 (April 2026), each mapped to the Danzell questions that test it and the Cyber Essentials Plus test case that audits it.

Source document: https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf. Site index: https://cyberessentialspreparation.com/llms.txt.

## The five controls
- [Firewalls](https://cyberessentialspreparation.com/requirements/firewalls.md): To make sure that only secure and necessary network services can be accessed from the internet. Tested by questions A4.x (https://cyberessentialspreparation.com/questions/firewalls.md) and CE Plus test 1: external vulnerability scan.
- [Secure Configuration](https://cyberessentialspreparation.com/requirements/secure-configuration.md): Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role. Tested by questions A5.x (https://cyberessentialspreparation.com/questions/secure-configuration.md).
- [Security Update Management](https://cyberessentialspreparation.com/requirements/security-update-management.md): Ensure that devices and software are not vulnerable to known security issues for which fixes are available. Tested by questions A6.x (https://cyberessentialspreparation.com/questions/security-update-management.md) and CE Plus test 2: authenticated patch scan.
- [User Access Control](https://cyberessentialspreparation.com/requirements/user-access-control.md): Ensure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role. Tested by questions A7.x (https://cyberessentialspreparation.com/questions/user-access-control.md) and CE Plus test 4: MFA on cloud services; test 5: account separation.
- [Malware Protection](https://cyberessentialspreparation.com/requirements/malware-protection.md): To restrict execution of known malware and untrusted software, from causing damage or accessing data. Tested by questions A8.x (https://cyberessentialspreparation.com/questions/malware-protection.md) and CE Plus test 3: malware protection tests.

## Scope
- [Scope overview](https://cyberessentialspreparation.com/requirements/scope.md): Whole organisation or sub-set, the scope conditions, and what cannot be excluded.
- [BYOD](https://cyberessentialspreparation.com/requirements/scope/byod.md): When user-owned devices are in scope and the native voice, text and MFA app exception.
- [Home and remote working](https://cyberessentialspreparation.com/requirements/scope/home-and-remote-working.md): Home devices are in scope; home routers are out unless supplied by the organisation.
- [Wireless devices](https://cyberessentialspreparation.com/requirements/scope/wireless-devices.md): When wireless access points are in scope.
- [Cloud services](https://cyberessentialspreparation.com/requirements/scope/cloud-services.md): IaaS, PaaS and SaaS responsibilities; cloud services cannot be excluded.
- [Third-party accounts and MSPs](https://cyberessentialspreparation.com/requirements/scope/third-party-accounts-and-msps.md): Accounts you own are in scope even when a supplier uses them.
- [Third-party devices](https://cyberessentialspreparation.com/requirements/scope/third-party-devices.md): The in and out of scope table for staff, volunteers, contractors and others.
- [Software development](https://cyberessentialspreparation.com/requirements/scope/software-development.md): Web applications in scope and the Software Security Code of Practice.
- [Asset management](https://cyberessentialspreparation.com/requirements/scope/asset-management.md): The inventory behind all five controls.

## Related
- [Backups](https://cyberessentialspreparation.com/requirements/backups.md): Not a technical requirement, but recommended and given its own section in v3.3.
- [What changed in 2026](https://cyberessentialspreparation.com/changes/2026-danzell-v3-3.md): The v3.3 and Danzell changes from 2026-04-27.
- [Checklists](https://cyberessentialspreparation.com/checklists.md): The requirements as a control-by-control checklist with evidence.