{
  "version": "2026-08-04",
  "scheme": "Cyber Essentials",
  "requirementsVersion": "v3.3",
  "licence": "CC BY 4.0",
  "note": "Question set and control structure for a Cyber Essentials v3.3 readiness self-assessment, with the answers that cause outright assessment failure flagged. Verified against IASME change notices on 4 August 2026. Question references are identifiers; all explanatory notes are original. Not affiliated with IASME or the NCSC.",
  "lastReviewed": "2026-08-04",
  "dateCaveat": "IASME's published change notices give different cutover days for v3.3 (26 and 27 April 2026), and other summaries say 28 April. Confirm with your certification body if you are opening an assessment account near that boundary.",
  "sources": [
    {
      "label": "IASME: changes to Cyber Essentials for April 2026",
      "url": "https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/"
    },
    {
      "label": "IASME: upcoming changes to the Cyber Essentials scheme",
      "url": "https://iasme.co.uk/articles/upcoming-changes-to-the-cyber-essentials-scheme-april-2026-update/"
    }
  ],
  "controls": [
    {
      "id": "firewalls",
      "name": "Firewalls",
      "plain": "Something between your devices and the internet, configured rather than merely present.",
      "purpose": "Almost every device ships with a firewall and almost nobody checks what it permits. The control is about the rules, not the box."
    },
    {
      "id": "secure-configuration",
      "name": "Secure configuration",
      "plain": "Devices and services set up deliberately, with what you do not need removed.",
      "purpose": "Default configurations are built to work on first boot, not to be defensible. Accounts, services and software you never chose are the exposure."
    },
    {
      "id": "user-access",
      "name": "User access control",
      "plain": "People have the access their job needs, and prove who they are properly.",
      "purpose": "This is where v3.3 tightened hardest. Accounts outlive the reason they were created, and administrative rights spread quietly."
    },
    {
      "id": "malware",
      "name": "Malware protection",
      "plain": "Something stopping malicious code running, by one of the approved routes.",
      "purpose": "There is more than one acceptable answer here, and the scheme accepts allow-listing and sandboxing as well as anti-malware software."
    },
    {
      "id": "updates",
      "name": "Security update management",
      "plain": "High-risk and critical updates applied within fourteen days, everywhere in scope.",
      "purpose": "The clearest, hardest number in the scheme. It is also the one most often failed, because the fourteen days apply to everything in scope and not just to servers."
    }
  ],
  "questions": [
    {
      "id": "fw-boundary",
      "control": "firewalls",
      "text": "Is every device in scope protected by a firewall, including laptops used on home or public networks?",
      "why": "A boundary firewall covers the office. A laptop in a coffee shop is outside it, so the software firewall on the device is what the scheme is asking about."
    },
    {
      "id": "fw-default-deny",
      "control": "firewalls",
      "text": "Are inbound connections blocked by default, with any exception documented and approved?",
      "why": "Assessors ask what is open and why. An exception nobody can explain is treated as an exception nobody manages."
    },
    {
      "id": "fw-admin",
      "control": "firewalls",
      "text": "Is the firewall's administrative interface unreachable from the internet, or protected by MFA if it is reachable?",
      "why": "A management interface exposed to the internet is the failure that turns a firewall into an entry point."
    },
    {
      "id": "sc-defaults",
      "control": "secure-configuration",
      "text": "Have default passwords been changed on every device and service?",
      "why": "Including the ones nobody logs into: printers, network kit, cameras, the appliance a supplier installed and never mentioned again."
    },
    {
      "id": "sc-unused",
      "control": "secure-configuration",
      "text": "Have unnecessary accounts, software and services been removed or disabled?",
      "why": "Not disabled at the login screen but removed. Anything present is something to keep patched."
    },
    {
      "id": "sc-cloud-scope",
      "control": "secure-configuration",
      "text": "Have you identified every internet-accessible service that stores or processes your data, and included it in scope?",
      "why": "v3.3 defines a cloud service formally for the first time and confirms cloud services cannot be scoped out. The list is almost always longer than the one finance knows about.",
      "newInV33": true
    },
    {
      "id": "sc-justify",
      "control": "secure-configuration",
      "text": "Can you justify to an assessor anything you have excluded from scope?",
      "why": "v3.3 removed the vaguer scoping language and now expects any internet-connected device to be in scope unless you can explain the exclusion.",
      "newInV33": true
    },
    {
      "id": "ua-mfa-cloud",
      "control": "user-access",
      "text": "Is MFA enabled on every cloud service that offers it?",
      "why": "This is the change with teeth. MFA is mandatory wherever a cloud service makes it available, and it makes no difference whether the feature is free, bundled or costs extra. Leaving an available MFA option switched off fails the assessment outright.",
      "autoFail": true,
      "newInV33": true
    },
    {
      "id": "ua-admin-separate",
      "control": "user-access",
      "text": "Do administrators use separate accounts for administrative work and for email and browsing?",
      "why": "One of the oldest requirements and still one of the most commonly failed, usually because it is inconvenient rather than because anyone disagrees with it."
    },
    {
      "id": "ua-passwords",
      "control": "user-access",
      "text": "Do your password rules meet one of the scheme's accepted combinations, rather than being whatever the system defaulted to?",
      "why": "The scheme accepts more than one route, combining length with MFA or with a deny-list of common passwords. What it does not accept is a policy nobody chose.",
      "newInV33": true
    },
    {
      "id": "ua-leavers",
      "control": "user-access",
      "text": "Are accounts removed promptly when someone leaves or changes role?",
      "why": "Assessors sample this. A dormant account belonging to someone who left is the finding that undermines everything else you say about access control."
    },
    {
      "id": "ua-approval",
      "control": "user-access",
      "text": "Is there a documented approval step before an account is created or given administrative rights?",
      "why": "The scheme wants a process, not a recollection. Being able to say who approved a given administrator is the evidence."
    },
    {
      "id": "mw-approach",
      "control": "malware",
      "text": "Is every device in scope covered by one of the accepted approaches: anti-malware software, application allow-listing, or code executing only in a sandbox?",
      "why": "All three are legitimate. Organisations sometimes assume anti-malware software is the only acceptable answer and buy licences they did not need."
    },
    {
      "id": "mw-updated",
      "control": "malware",
      "text": "Where you use anti-malware software, does it update automatically and is it actually running everywhere?",
      "why": "Coverage gaps usually appear on the machines nobody manages centrally, which are also the machines most likely to be running something they should not."
    },
    {
      "id": "up-os",
      "control": "updates",
      "text": "Are high-risk and critical updates for operating systems, routers and firewall firmware installed within 14 days of release?",
      "why": "Question A6.4. Answering no fails the assessment. Router and firewall firmware is the part that catches people, because it is rarely on the same patching cycle as the estate.",
      "autoFail": true,
      "ref": "A6.4"
    },
    {
      "id": "up-apps",
      "control": "updates",
      "text": "Are high-risk and critical updates for applications, including their extensions and plug-ins, installed within 14 days of release?",
      "why": "Question A6.5, and also an outright failure. Extensions and plug-ins are explicitly included, which is where browser add-ins and content management plug-ins land.",
      "autoFail": true,
      "ref": "A6.5"
    },
    {
      "id": "up-supported",
      "control": "updates",
      "text": "Is everything in scope still supported by its vendor and receiving security updates?",
      "why": "Unsupported software cannot be patched within 14 days, or at all, so it has to be removed from the estate or removed from scope with a justification an assessor accepts."
    },
    {
      "id": "up-licensed",
      "control": "updates",
      "text": "Is all software licensed and supported, including anything a supplier or contractor installed?",
      "why": "The estate an assessor examines includes the machine in the corner running the thing that only one person understands."
    }
  ]
}