Policies for Cyber Essentials

Cyber Essentials does not require you to submit a written set of policies. The assessment checks technical controls, not paperwork. But several questions ask how you do things: who approves a new firewall rule, how user accounts are approved and removed, how updates are installed within 14 days. Those are processes, and a good answer describes a process that already exists.

That is what policies are for. A policy pack writes those processes down, so your answers are consistent, staff know what to do, and the next renewal starts from a record rather than from memory. It lays the foundation your organisation builds on.

Where the questions ask about processes

• Firewall rules (A4.5 and A4.6). Inbound rules are approved by an authorised person, the business need is recorded, and rules that are no longer needed are removed.
• Security updates (A6.4 and A6.5). Critical and high-risk updates are installed within 14 days of release. See the 14-day update rule.
• User accounts (A7.1 and A7.3). Accounts are created only after approval, and removed or disabled when people leave. See how to answer the user access questions.
• Malware protection. Which protection each type of device uses, and how it is kept up to date. See malware protection.

The assessor marks your answers, not your documents. Policies help because they make the answers true and repeatable.

What a useful pack covers

• An information security policy: who is responsible, and what your Cyber Essentials scope includes.
• One document for each of the five controls, written the way your organisation works.
• The parts of scope that catch applicants out: cloud services, personal devices, home working and IT suppliers.
• An account lifecycle procedure for joiners, movers and leavers.
• Good practice beyond the scheme, such as backup and incident response.

Generic templates often describe a setup you do not have. Tailor each document to how your people work, the devices you use, who looks after your IT and which cloud platforms you rely on, and remove anything that does not apply.

Our free policy pack

The CyberEssentials.AI policy pack builder asks how your organisation is set up and writes a pack of editable Word documents for Cyber Essentials Requirements v3.3, with your organisation's name, logo and colour. You can read and edit every document in your browser before it is emailed to you. It is free, with no account needed.

You can also prepare it in Claude or another AI assistant through our MCP server. The assistant asks the same questions, then gives you a link that opens the builder with your answers filled in.

The Self-Assessed, Guided and Managed packages each include a customised policy pack as part of the service. See pricing.