How to answer the Cyber Essentials questions

A good Cyber Essentials answer describes what is true in your organisation on the day you submit, in enough detail that an assessor can see the requirement is met. Name the products and versions, describe the setting or process, and say who is responsible. A "Yes" with nothing behind it, or a plan for next month, is the most common reason a submission is queried.

The current question set is called Danzell. It applies to assessment accounts created from 27 April 2026 and is based on the NCSC's Requirements for IT Infrastructure v3.3. IASME publishes the questions free so you can prepare offline, but you submit your answers through the online assessment platform. Every question must be answered, and a board-level person, business owner or equivalent must approve the answers. Your Certification Body marks the real submission; this guide is Apexward's own advice from public sources, not IASME's marking scheme.

What the questions are checking

The question set is the requirements document turned into questions. Sections A1 to A3 cover your organisation, scope and the included insurance. Sections A4 to A8 cover the five controls: firewalls, secure configuration, security update management, user access control and malware protection. For each control, the assessor is checking two things:

• that the requirement is met on every device, account and cloud service in your scope
• that you understand how it is met, so it will stay met

What a good answer includes

1. Products and versions. "Microsoft Defender Antivirus on all Windows 11 Pro 25H2 laptops" tells the assessor more than "antivirus installed". Some questions require versions, for example Windows edition and feature version, and the versions of browsers and office software.
2. How it is done. Say which setting, policy or tool enforces it: Intune, Group Policy, an MDM profile, the router's admin page, or a written procedure.
3. Who does it. Name the role: "the office manager approves new accounts", "our IT provider applies firmware updates monthly".
4. Coverage. Say it applies to all devices in scope, including home workers and personal devices (BYOD) that reach organisational data.
5. Exceptions. If something is different, such as one server patched by hand, say so and say how it still meets the rule.

Keep it short. Two or three plain sentences per notes field is usually enough. Do not paste whole policies.

Watch the question wording

Most questions expect "Yes" for a compliant answer, but some do not. For example, one firewall question asks whether unauthenticated inbound connections are allowed, and one update question asks whether any software is unlicensed or unsupported. For those, the compliant answer is "No". Read each question twice.

Keep your answers consistent

Assessors cross-check sections. Common contradictions:

• the scope section lists Windows 10 or an old macOS version, but the update section says everything is supported
• the cloud services list includes a service that the MFA answers do not mention
• the device counts do not fit the number of staff and home workers you declared
• you say there are no administrators with separate accounts, but also that staff install their own software

What to leave out

Do not give IP addresses, MAC addresses, serial numbers or passwords. Do not list home routers you do not supply. Do not describe future plans as if they were in place.

Answers that fail

IASME has confirmed that the cloud MFA questions (A7.14 to A7.17) are automatic fails when MFA is available but not turned on. The 14-day update questions (A6.4 and A6.5) are also automatic fails under Danzell. Beyond those, any answer that shows a requirement is not met will fail the assessment anyway, so there is no such thing as a safe "No".

Timings after you submit

You have 6 months from applying to complete the assessment. IASME's guidance says the assessor reviews within 3 working days. If they ask for more information, or the submission fails, you correct things and resubmit. How long you have depends on who certifies you: 2 working days if you certify directly with IASME, or up to the end of the six months your assessment is open if you certify with Apexward Group through CyberEssentials.AI. If you pass, the certificate is valid for 12 months.

Checklist before you submit

• Every answer is true today, not planned.
• Products, versions and settings are named.
• Responsibilities are named by role.
• Home workers, BYOD and cloud services are covered.
• The scope section matches the control sections.
• The person signing the declaration has read the answers.

Our readiness checker asks the same areas as yes or no questions and lists what to fix before you start. See also common reasons for failing and automatic fail questions.