Requirements for IT Infrastructure v3.3 is the NCSC document every Cyber Essentials assessment is marked against. It defines scope, including BYOD, home working and cloud services, and sets the requirements for the five controls: firewalls, secure configuration, security update management, user access control and malware protection. It is Crown Copyright under the Open Government Licence.
Key takeaways
- NCSC Requirements for IT Infrastructure v3.3 (April 2026) defines the five Cyber Essentials controls and the scope rules, and applies with the Danzell question set from 27 April 2026.
- Section 3 requires critical and high-risk updates, a CVSS v3 base score of 7 or above, to be installed within 14 days of release.
- Section 4 states that FIDO2 authenticators are regarded as MFA, and cloud services cannot be excluded from scope under v3.3.
First sections
- 01What's new in v3.3: six changes from v3.2
- 02A. Introducing the technical controls
- 03B. Definitions: devices, licensed and supported software, MFA, organisational data and services, passwordless, sub-set
- 04C. Backing up your data (recommended, not required)
- 05D. Scope: BYOD, home and remote working, wireless, cloud services, third parties, sub-sets
- 06E. Requirements by technical control theme
And 6 more, listed under what is inside.
- Format
- Access
- Free, links to the official PDF
- Who it is for
- Everyone completing an assessment. Question A1.11 asks whether you have read it.
- Sections
- 12
- Written against
- Requirements v3.3 (April 2026), Danzell question set
- Last updated
- 2026-11-03
NCSC Cyber Essentials Requirements for IT Infrastructure v3.3
Published by the NCSC or IASME. We link to the original rather than re-host it. Opens in a new tab.
Open the originalWhat is this document?
The technical standard for Cyber Essentials, published by the NCSC as a PDF. IASME's question set asks the questions; this document sets the requirements the answers are marked against. Every "CE Requirement" line in the Danzell guidance is a quotation from it.
What does it contain?
Sections A to D cover the introduction, definitions, backups and scope. Section E holds the five controls, numbered 1 to 5, and section F is further guidance on zero trust. Each control has an "applies to" line, an aim, an introduction and a requirements list. The requirements hub follows the same structure.
| Section | Requirement pages on this site |
|---|---|
| D. Scope | Scope, BYOD, Cloud services |
| 1. Firewalls | Firewalls |
| 2. Secure configuration | Secure configuration |
| 3. Security update management | Security update management |
| 4. User access control | User access control |
| 5. Malware protection | Malware protection |
Which sentences matter most?
"Be updated, including vulnerability fixes, within 14 days of release" in section 3, and its definition of critical or high risk as a CVSS v3 base score of 7 or above. "FIDO2 authenticators are regarded as MFA because user authentication is performed" in section 4. "user-owned devices which access organisational data or services (as defined above) are in scope" in section D, with the three exceptions for native voice, native text and MFA applications. And in the new material: cloud services cannot be excluded from scope.
What are the thresholds in it?
| Control | Threshold | Question |
|---|---|---|
| Firewalls | Default passwords on boundary firewalls changed; inbound rules removed or disabled quickly when no longer needed, with a rule review A4.6 asks about over the last 12 months | A4.2, A4.6 |
| Secure configuration | Device unlock PIN or password of at least 6 characters where it only unlocks the device; no more than 10 guesses in 5 minutes, or lock after no more than 10 attempts | A5.9, A5.10 |
| Security update management | Critical and high-risk fixes, CVSS v3 7 or above or unrated, installed within 14 days of release | A6.4AUTO-FAIL, A6.5AUTO-FAIL |
| User access control | Passwords: MFA, or a 12-character minimum, or an 8-character minimum with automatic blocking of common passwords; MFA password element at least 8 characters | A7.11, A7.16AUTO-FAIL, A7.17AUTO-FAIL |
| Malware protection | On Windows and macOS, anti-malware updated in line with the vendor, preventing malware from running and blocking malicious websites; on any device, application allow-listing restricted by code signing | A8.1, A8.2, A8.3 |
Each control page in the requirements hub quotes the full wording.
This page summarises the document. The PDF at the NCSC is the version of record; where this site and the PDF differ, the PDF is right and we would like to know.
What is inside
| # | Section |
|---|---|
| 01 | What's new in v3.3: six changes from v3.2 |
| 02 | A. Introducing the technical controls |
| 03 | B. Definitions: devices, licensed and supported software, MFA, organisational data and services, passwordless, sub-set |
| 04 | C. Backing up your data (recommended, not required) |
| 05 | D. Scope: BYOD, home and remote working, wireless, cloud services, third parties, sub-sets |
| 06 | E. Requirements by technical control theme |
| 07 | 1. Firewalls |
| 08 | 2. Secure configuration, including device unlocking credentials |
| 09 | 3. Security update management and the 14-day rule |
| 10 | 4. User access control: accounts, passwords, MFA, passwordless |
| 11 | 5. Malware protection |
| 12 | F. Further guidance: zero trust and Cyber Essentials |
Frequently asked questions
The document lists six changes: a definition for cloud services, the passwordless definition updated to include FIDO2, a definitive statement that cloud services cannot be excluded from scope, the Software Security Code of Practice introduced in the software development section, scope criteria no longer referring to untrusted connections, and more emphasis on backing up data.
Question A1.11 asks whether you have read it, and the answer is expected to be yes. The PDF is 26 pages. The requirements hub on this site covers it section by section with the wording quoted where an assessor relies on it.
The document is Crown copyright. The NCSC's website terms say its content, unless stated otherwise, may be reused under the Open Government Licence v3.0 if you acknowledge the source. This site quotes it throughout with attribution to the NCSC.
Yes. The NCSC publishes a Welsh translation of Requirements v3.3, linked from IASME's question set preview page alongside the Welsh question set and the Welsh Cyber Essentials Plus test specification.
More from the library
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Website terms and conditions (Open Government Licence)Read on ncsc.gov.uk (opens in a new tab)