PRACTICAL GUIDANCE
What this review is for
Understand your Cyber Essentials scope and work through the five technical control areas. Identify practical gaps before entering the independent scheme assessment.
Who this is for. For organisations preparing a first Cyber Essentials application, renewing after technology changes, or checking what a customer’s Cyber Essentials requirement means for their services.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Identify the organisation, devices, services, users and relevant boundaries proposed for assessment.
- Review firewalls, secure configuration, security update management, user access control and malware protection.
- Check responsibility for cloud services, managed IT and other outsourced technology.
- Work through the current official question set and requirements rather than an undated checklist.
- Record gaps, uncertain answers and technical remediation that the organisation or its IT provider must complete.
Evidence to prepare
- An asset and software inventory, including support status and ownership.
- A description of network boundaries, remote working and cloud services.
- Configuration and update-management evidence selected for the agreed scope.
- Account, privilege and authentication arrangements, without disclosing passwords or secrets.
- IT supplier responsibilities and previous Cyber Essentials assessment information where relevant.
What the review is intended to produce
- A draft scope description with boundaries and unresolved questions.
- A control-area gap register linked to the current official requirements.
- A remediation plan with responsible owners and evidence needed for each action.
- An evidence index to support accurate completion of the official assessment.
- A handover note for the organisation and its chosen licensed certification body.
How the work is structured
Establish the technology scope
Resolve what is included and who controls it. A narrow inventory that misses ordinary working devices creates unreliable answers.
Review the five control areas
Use the current scheme requirements and obtain evidence from the people who manage the technology. Record unsupported answers as unresolved.
Remediate and recheck
The organisation or its authorised IT provider implements changes. Confirm the resulting state before updating the assessment response.
Move to the scheme assessment
The organisation completes the official route through IASME or a licensed certification body. The readiness review does not make the certification decision.
Service boundaries
- Cyber Essentials certification is provided through IASME and its licensed certification bodies. This readiness service does not issue Cyber Essentials or Cyber Essentials Plus certificates.
- Cyber Essentials is an NCSC scheme, not an ISO standard. ISOaudit does not claim NCSC or IASME approval and does not issue Cyber Essentials certificates.
- Readiness support does not imply vulnerability scanning, penetration testing or changes to live systems. Any technical testing needs a separate authorised scope.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Is this Cyber Essentials certification?
No. This page describes preparation. The official certification process is delivered through the scheme operated by IASME, the NCSC delivery partner.
Is Cyber Essentials the same as ISO 27001?
No. Cyber Essentials focuses on specified technical controls. ISO/IEC 27001 addresses a broader information security management system. A customer may ask for either, both or a particular scope.
Does readiness for Cyber Essentials mean readiness for Plus?
Do not assume so. Cyber Essentials Plus includes independent technical verification. Discuss its scope, testing arrangements and prerequisites with a licensed certification body.
FICTIONAL WORKED EXAMPLE
Fictional example: reconciling the technology scope before answering
A fictional business prepares for Cyber Essentials while an external IT provider manages part of its technology. This educational scenario describes no actual vulnerability or certified organisation.
| Criteria to establish | Use the current NCSC Cyber Essentials requirements and IASME assessment route, with the scope agreed for the organisation. This is a separate scheme from UKAS-accredited management-system certification. |
|---|---|
| Evidence and sample | Reconcile the proposed device, software and cloud-service inventory with relevant operational records. Explain what was checked and any unknown ownership or management boundaries. |
| What the evidence shows | The fictional inventory lists office equipment but does not explain ordinary remote-working devices. The provider's general assurance does not resolve whether the proposed scope is complete. |
| Next step | Ask the authorised technology owners to clarify the scope and control responsibilities, then obtain evidence for the relevant answers. Take unresolved scheme questions to an IASME-licensed certification body. |
This readiness exercise issues no certificate and authorises no scanning or live-system changes. Cyber Essentials Plus requires its own independent technical verification.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.
Source correction: Clarified that Cyber Essentials certification is delivered through IASME-licensed certification bodies; this readiness specification does not issue a certificate.