How to Get Cyber Essentials Certification and Pass First Time

Updated October 2026 for the Danzell question set. Written by the assessors at Sovereign Secure, an IASME-licensed Cyber Essentials certification body.

This guide shows how to get Cyber Essentials certified and how to pass Cyber Essentials first time. Passing first time saves time and money, gives you confidence that your basic controls are genuinely in place and opens doors to contracts that require Cyber Essentials certification. These are the six steps we see successful applicants follow.

How to get Cyber Essentials certification: the six steps

1. Understand the requirements. Learn the five technical controls and the rules for each, from the NCSC Requirements for IT Infrastructure v3.3.
2. Define your scope. Decide whether you certify the whole organisation or a separated part, and list every device, network and cloud service in it.
3. Fix the common failures first. Turn on MFA for every cloud service, remove unsupported software and install high and critical updates within 14 days.
4. Answer every question in detail. Describe what you do today, and how, in the IASME assessment portal.
5. Get expert guidance. Have an assessor check your answers before you submit.
6. Submit with confidence. Do a final review and submit for assessment by a licensed certification body.

1. Understand the requirements

Before you start, read the requirements. The scheme focuses on five technical control areas:

• Firewalls: protect your internet connection and internal network from external threats.
• Secure configuration: make sure devices and software are configured securely, with defaults changed and unused software removed.
• User access control: limit access to data and services to those who need it, and use MFA on every cloud service.
• Malware protection: run effective anti-malware or application allow-listing.
• Security update management: keep software supported and apply high and critical updates within 14 days.

Our Cyber Essentials requirements and checklist turns each control into checks you can work through device by device.

2. Define your scope

Getting scope right is the single most important step. Identify every network and device under your organisation’s control, including:

• Office networks and the devices on them
• Home and remote workers, including personal devices used for work
• Shared facilities
• Cloud services such as Microsoft 365 or Google Workspace, which can never be excluded
• Anything managed by an outsourced IT provider

A clear scope means your submission is complete and accurate. If you are unsure, our Cyber Essentials scope questionnaire walks you through it.

3. Prepare thoroughly and fix the common failures

• Review the questions in advance. Our Cyber Essentials questionnaire page explains each section and has a spreadsheet for drafting answers offline.
• Review your policies and procedures so they match what the scheme asks for.
• Brief your team on why the controls matter, particularly MFA and updates.
• Fix known gaps first: missing MFA, unsupported operating systems and late updates are the most common causes of failure. The table in the next section covers these and seven more.

Not sure where you stand? Our free Cyber Essentials readiness check takes a few minutes and shows your likely failures.

How hard is it to get Cyber Essentials?

Not hard, if three things are right before you submit: your scope, MFA on every cloud service, and software that is still supported and up to date. The controls are basic by design, and many of them, such as MFA and automatic updates, are settings in systems you already use. Submissions fail on detail, not difficulty: one cloud app without MFA, one laptop on an unsupported operating system or one update more than 14 days late can be enough.

The work is usually in the fixes rather than the questionnaire. Turning on MFA or automatic updates takes days. Replacing unsupported hardware, or changing how an outsourced IT provider manages your devices, can take weeks, so find those early. Answers matter too: an assessor can only pass what you describe, so say what you do today and how.

Cyber Essentials Plus is harder in one way only: an assessor tests a sample of your devices, so an answer that is true for most devices but not all will be found. The requirements are the same.

Top 10 reasons Cyber Essentials submissions fail

Ten problems our assessors regularly raise, and how to fix each one before you submit.

4. Answer every question in detail

You answer the questions in the IASME assessment portal, where you can save drafts and come back to them; our IASME portal guide shows how it works. The questionnaire can feel daunting. Take your time. The most common problems we see are:

• Incomplete or one-word answers where detail is needed
• Misunderstanding what a question is asking
• Not describing how a control is actually implemented

Clear, specific answers that describe what you do, and how, give the assessor what they need to pass you. Our questionnaire page has example answers for the Cyber Essentials self-assessment.

5. Get expert guidance

If an area is confusing, ask. Every one of our Cyber Essentials packages includes a pre-assessment check and a support call of up to an hour with an assessor, so questions are resolved before you submit rather than after you fail. If you need more hands-on help, for example because nobody in-house manages your IT, see Cyber Essentials consultancy and support.

6. Submit with confidence

Before you press submit, do a final review:

• Every question is answered
• Scope is described accurately, including anything excluded
• Your answers reflect how things really are today, not how they will be next month
• A board member or equivalent has reviewed the answers and is ready to sign the declaration

Once you submit, your Cyber Essentials assessor at the certification body marks each answer against the requirements. If something does not meet them, the assessor explains why and you can amend and resubmit within your package limits. Our guide to the Cyber Essentials assessment shows how answers are marked and which ones fail most often.

How long does it take to get Cyber Essentials, and how quickly can you get it?

Most organisations take a few days to a few weeks to prepare, depending on how much needs fixing. Once you submit, we assess within one working day on our Gold package, two on Silver and three to five on Bronze. If an assessor asks for clarification, your package sets how many resubmissions you have and how long you have to pass.

This table shows where the time goes, step by step:

How quickly can you get it? If your controls are already in place, you can answer the questions, have them checked and be certified within days: a Gold submission is assessed within one working day. The quickest routes all start the same way: run the readiness check first, so you know there is nothing that takes weeks to fix.

What happens next?

Your certificate lasts 12 months, so plan your Cyber Essentials renewal before it expires. If a customer asks for more assurance, Cyber Essentials Plus adds a technical audit and must be completed within three months of your basic certificate. See Cyber Essentials Plus cost for published UK prices by company size.

Ready to start? Compare Cyber Essentials prices, which start at £320 + VAT, or read our Cyber Essentials FAQs. For the official background, see the NCSC Cyber Essentials overview.