What Happens in a Cyber Essentials Assessment? An Assessor's View

A Cyber Essentials assessment is a verified self-assessment: an assessor at a licensed certification body reviews your answers to IASME’s online questionnaire. You define your scope, answer the Danzell question set in the assessment portal, and a board-level representative signs a declaration that the answers are true. The assessor then marks each answer against the NCSC requirements, asks for clarification or flags anything that fails, and issues a certificate valid for 12 months once every requirement is met. With us, marking takes between one and five working days, depending on the package.

You can preview the Cyber Essentials self-assessment questions on IASME’s website, or download our free Cyber Essentials questionnaire to draft your answers offline. We are an IASME-licensed certification body, so this guide is written from the marking side of the desk. It covers each stage of the assessment, how answers are judged, the answers that fail most often and how to avoid them.

Key takeaways

• Basic Cyber Essentials is assessed online from your written answers; there is no site visit.
• The assessor marks the rule, not the intention: “we’re working on it” fails.
• Missing cloud MFA and missing the 14-day patching deadline are automatic fails under Danzell.
• Vague or one-word answers are the most common reason for queries and resubmissions.
• Your package sets how many resubmissions you get and how long you have to pass.

What happens in a Cyber Essentials assessment?

The assessment follows the same stages for every organisation:

Our Cyber Essentials assessment questions page explains each section of the question set, so you can draft answers with your IT provider before you open the portal. Buyers checking your certificate afterwards use the public search described on our Cyber Essentials certificate check page.

What does a Cyber Essentials assessor look for?

Three things, in order.

A complete, honest scope. The first section describes your organisation and what the certificate covers. Since April 2026 that includes every legal entity, with company numbers, and a description of anything excluded. If your answers later mention home workers, a second office or a cloud app that the scope leaves out, the assessor will query it.

Consistency. Answers are read together. If you say all laptops run a supported operating system, then list a version past its end-of-support date, the list wins. If you say admin rights are restricted but describe staff installing their own software, expect a question.

The rule, not the intention. The assessor marks what is true on the day you submit, against the NCSC’s Requirements for IT Infrastructure. “We plan to enable MFA next month” is a fail today. Our Cyber Essentials requirements checklist lists every rule the answers are marked against. If you are still choosing who will mark your answers, our guide to choosing a Cyber Essentials assessor explains what to check.

How are Cyber Essentials answers marked?

Each answer falls into one of three outcomes:

1. Meets the requirement. No further action.
2. Needs clarification. The answer may be compliant but doesn’t say enough. The assessor asks a specific question, and a clear reply usually resolves it.
3. Does not meet the requirement. The assessor explains why. You fix the underlying issue, update the answer and resubmit.

Some answers fail the whole assessment on their own, whatever your other answers say. Under the Danzell question set, IASME treats these as automatic fails:

• a cloud service that offers MFA without it enforced;
• high-risk or critical updates for operating systems, or router and firewall firmware, not installed within 14 days;
• high-risk or critical updates for applications, including browser extensions and associated files, not installed within 14 days.

Unsupported software in scope will also fail until it is upgraded, removed or moved to a segregated network outside scope. Our guide to the Cyber Essentials changes for 2026 explains the Danzell marking changes in full.

How many chances you get depends on your package:

Each extra resubmission after your package limit costs £100 + VAT. Prices for each package are on our Cyber Essentials cost page.

Which answers fail most often?

These are the answers we send back most, and what a passing answer looks like instead.

None of these are hard to fix. They are usually a sign that nobody checked the whole estate before answering. Our guide to the five Cyber Essentials controls explains what sits behind each area.

How long does a Cyber Essentials assessment take?

Most of the time goes on preparation, which takes from a few days to several weeks depending on how many gaps you find. The answers themselves take a few hours if your IT records are in order.

Once you submit, marking takes 24 hours on Gold, 48 hours on Silver and three to five working days on Bronze with us. If something needs fixing, the clock is your package’s time to pass. For a step-by-step plan to get through first time, see our guide on how to get Cyber Essentials certification.

Who needs to sign the declaration?

A board-level representative, or equivalent, must sign a declaration that the answers are accurate. That person is confirming the controls are in place across the whole scope, not just that the form was filled in. Brief them before they sign, particularly if an IT provider wrote the answers.

How is a Cyber Essentials Plus assessment different?

Cyber Essentials Plus starts from the same answers and adds a hands-on Cyber Essentials audit, completed within three months of the basic certificate. The assessor scans your internet-facing systems, checks a sample of devices for missing updates, tests malware defences with harmless files and checks MFA on cloud services. Since April 2026 the self-assessment must be finalised and left unchanged before Plus testing starts, so you can no longer adjust answers based on what the audit finds. Accurate answers at the basic stage matter more.

Our Cyber Essentials Plus requirements checklist covers the audit day, and our comparison of Cyber Essentials vs Cyber Essentials Plus explains which level you need.

Why use Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, so preparation support and certification come from one organisation. Every package includes a pre-assessment check of your draft answers and a support call of up to an hour, which is where most queries get resolved before marking starts. We are also ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company. Background on the scheme is on the NCSC Cyber Essentials overview.

Next step

Choose a package for your Cyber Essentials certification, starting at £320 + VAT, and send us your draft answers for a pre-assessment check. If you’d rather have someone work through the gaps with you or your IT provider first, our Cyber Essentials consultancy team can help.