Cyber Essentials, explained by the assessors who mark it.
Free guides to every v3.3 requirement and all 106 questions in the 2026 Danzell set, a readiness checker that flags auto-fails first, and fixed-price certification from Precursor, an IASME Certification Body.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
- questions
- 106
- sections
- 8
- controls
- 5
- auto-fail
- 5
Cyber Essentials is the UK government-backed certification, owned by the NCSC and delivered by IASME, that checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. You certify by answering the 106-question Danzell set, marked by a Certification Body, for £320 to £600 + VAT. Certificates last 12 months.
Start with the control you are least sure about
Each hub explains what the requirement says in v3.3, what the assessor checks, and which Danzell questions it answers.
Requirements v3.3 and the Danzell question set
The scheme moved to v3.3 of the requirements and a new question set on 27 April 2026. If you certified under the previous set, these are the changes to read first.
- A definition of cloud services is provided, and cloud services cannot be excluded from scope.
- Passwordless authentication is redefined to include FIDO2.
- The Software Security Code of Practice is introduced in the software development section.
- Scope criteria no longer refer to untrusted connections.
- The importance of backing up data is emphasised.
Four fail the self-assessment on a No answer, whatever else you get right. A7.15 fails if a cloud service you list there does offer MFA. Check them before anything else.
- A6.4Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?
- A6.5Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?
- A7.15If you have answered ‘No’ to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.Fails if a cloud service listed there does offer MFA
- A7.16Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?
- A7.17Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?
Find out where you stand before you pay anyone
Built by the assessors, no account needed. Results by email where a tool needs one.
Four steps from scope to certificate
Scope, prepare, assess, certify. How long it takes with Precursor depends on how much remediation the gap analysis finds.
- Step 1
Scope
Agree the boundary: whole organisation or a sub-set segregated by firewall or VLAN. End-user devices and cloud services are always in.
Scope guide - Step 2
Prepare
Work through the five controls and gather evidence question by question. A gap analysis finds the failures before the assessor does.
Checklists - Step 3
Assess
Complete the Danzell question set on the IASME portal and have a board member sign it off. Cyber Essentials Plus adds an audited test within three months.
Question set - Step 4
Certificate
A digital certificate, listed on the IASME certificate search, with included cyber liability insurance for eligible organisations. Renewed annually.
What a certificate shows
- Cyber Essentials
- 1 to 2 weeks
- Cyber Essentials Plus
- 2 to 5 weeks, within 3 months of your Cyber Essentials certification
- Gap analysis
- 1 to 3 days
Two routes to the same certificate
You can self-assess directly through any Certification Body for the IASME fee alone. Pay an assessor when you want your answers checked before they are marked. Both routes end with the same certificate.
IASME self-assessment fee, ex VAT
| Band | Staff | Fee |
|---|---|---|
| Micro | 0 to 9 | £320 |
| Small | 10 to 49 | £440 |
| Medium | 50 to 249 | £500 |
| Large | 250+ | £600 |
Verified on iasme.co.uk on 4 November 2026. If a self-assessment fails, IASME's terms allow one free resubmission within 48 hours of the fail notice. UK micro and SME organisations (up to 249 staff) that have not held Cyber Essentials in the last four years can get 75% off the fee through IASME's government-funded offer until 31 March 2027. Precursor prices below are + VAT.
Full cost breakdownCyber Essentials
1 to 2 weeks
- Assessor-supported self-assessment
- IASME fee included
- Free re-test if gaps are found
Cyber Essentials PlusAudited
2 to 5 weeks, priced by device count
- Technical audit, on site or remote
- Everything in Cyber Essentials included
- IASME fee included
- Free re-test within 90 days
Gap analysis
1 to 3 days
- Gap identification
- Remediation guidance
- Recommended for first-time applicants
Guides for your sector, platform and software
By sector
Contract and regulator expectations, and the questions that trip each sector up.
Browse all by sector guidesBy platform
Setting-by-setting guides for the platforms most applicants run.
Browse all by platform guidesBy software
Support dates for operating systems and applications, because all in-scope software must be licensed and supported.
Browse all by software guidesStraight answers before you start
Scheme facts come from the NCSC requirements document and the IASME question set. Prices are Precursor's own.
Cyber Essentials is the UK government-backed certification scheme run by the NCSC and delivered by IASME. It sets five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certification is by self-assessment, with Cyber Essentials Plus adding an independent technical audit.
Requirements for IT Infrastructure moved to v3.3 and the Danzell question set (v16.3) replaced the previous set from 27 April 2026. v3.3 adds a definition of cloud services, states that cloud services cannot be excluded from scope, updates passwordless authentication to include FIDO2, introduces the Software Security Code of Practice and emphasises backups.
The IASME self-assessment fee is £320 for micro organisations (0 to 9 staff), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250+), all ex VAT. Precursor's assessor-supported Cyber Essentials is from £1,500 + VAT with the IASME fee included, Cyber Essentials Plus from £3,000 + VAT by device count with Cyber Essentials included, and a gap analysis from £500 + VAT. Until 31 March 2027, IASME's government-funded offer takes 75% off the self-assessment fee for UK organisations under 250 staff that have not held Cyber Essentials in the last four years.
Four questions in the 2026 Danzell set fail the assessment outright on a No answer: A6.4 and A6.5 (critical or high-risk updates installed within 14 days) and A7.16 and A7.17 (MFA applied to all cloud service administrators and users). A7.15 fails automatically if a cloud service listed there as having no MFA option does offer MFA.
Under IASME's process you have six months from buying the assessment to submit it, and IASME says most assessors aim to return results within 3 days. With Precursor, Cyber Essentials typically takes 1 to 2 weeks and Cyber Essentials Plus 2 to 5 weeks, depending on device count and remediation. Cyber Essentials Plus must be completed within three months of the self-assessment certificate.
You can self-assess directly through any IASME Certification Body for the scheme fee alone. An assessor-supported route reviews your answers and evidence before submission, so problems are fixed before marking rather than after a fail. Both routes produce the same certificate, valid for 12 months.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh