In short: The Cyber Essentials question set is the list of questions answered in the online verified self-assessment. Since 27 April 2026 the current set is Danzell, aligned with the NCSC's Requirements v3.3. It covers your organisation, scope, insurance and the five technical controls, and IASME publishes it as a free booklet so you can prepare offline.
What the question set is
When you apply for Cyber Essentials, you answer a set of questions in IASME's online assessment portal. A board member or equivalent signs a declaration that the answers are true, and an assessor from a licensed Certification Body marks them. The same answers underpin Cyber Essentials Plus, whose technical tests check that what you said is what is really there.
The questions are reissued as the NCSC updates its requirements, and each version has a name:
| Question set | Requirements version | In use from |
|---|---|---|
| Montpellier | v3.1 | April 2023 |
| Willow | v3.2 | 28 April 2025 |
| Danzell (current) | v3.3 | 27 April 2026 |
What changed most recently is covered on our Danzell page. IASME offers the current questions as a free download, in PDF and Excel formats, so you can read them and draft answers before you open an assessment account. You still enter your final answers in the portal.
What the questions cover
The question set follows the structure of the Cyber Essentials requirements:
| Area | What you are asked about |
|---|---|
| Your organisation | Who you are, contact details and, under Danzell, every in-scope legal entity with its name, address and company number |
| Scope | Whole organisation or a sub-set, a description of the scope, and the devices, operating systems, networks and cloud services inside it |
| Insurance | Whether you want the included cyber liability insurance, if your organisation is eligible |
| Firewalls | Boundary and software firewalls, admin passwords, admin interfaces, inbound rules |
| Secure Configuration | Removing unneeded accounts and software, default passwords, auto-run, device locking |
| Security Update Management | Licensed and supported software, automatic updates, the 14-day rule (including questions A6.4 and A6.5) |
| User Access Control | Account processes, leavers, admin accounts, MFA and passwords |
| Malware Protection | Anti-malware or application allow listing on every in-scope device |
| Declaration | Sign-off by a board member or equivalent |
The scope questions do a lot of work. Listing your devices and their operating system versions is how an assessor spots unsupported software, so be accurate. Our scope guide explains what must be included.
Questions that fail you outright
Most non-compliant answers lead to feedback you can fix. Under Danzell, some answers fail the whole assessment on their own:
- No MFA on a cloud service that offers it, free, included or paid. See Cyber Essentials MFA requirements.
- Question A6.4: critical or high-risk updates to operating systems and router or firewall firmware not installed within 14 days.
- Question A6.5: critical or high-risk updates to applications not installed within 14 days.
Unsupported software needs the same attention. The requirements say all in-scope software must be licensed and supported, and under Danzell it must be supported on the date your certificate is issued, so an operating system or application past its vendor's end of support has to be upgraded, removed or isolated in a sub-set with no internet access before you submit. Windows 10 devices without Extended Security Updates are the classic example.
If your assessment fails, you receive feedback and have two working days to amend your answers at no extra cost. After that you need to reapply and pay again. Our common failures guide covers the other usual problems.
How to answer well
Assessors mark what you write, so give them enough to judge. Our advice:
- Describe what is true today. The certificate reflects the date it is issued, so do not answer for the setup you plan to have next month. Fix things first, then answer.
- Say how, not just yes. "Yes" tells the assessor little. "Windows and macOS updates install automatically through Intune; we review compliance reports weekly" shows the control is real.
- Name the products and settings. Which firewall, which anti-malware, which MFA method, which password policy.
- Be consistent. Devices and cloud services in your scope answer must match what you describe in the control sections.
- Be honest about gaps. A wrong answer signed by a director is a far bigger problem than a fixable gap.
- Keep a copy. You enter answers afresh every year at renewal, so a record of this year's answers and evidence is a head start.
Remember that under Danzell the director's declaration accepts responsibility for staying compliant throughout the certification period, not just on the day you submit.
Who should complete it
Usually the person who knows the IT best, whether an in-house IT lead or your managed service provider, drafts the technical answers, and a senior person reviews and signs. The signatory should understand what they are committing to. If your IT is managed externally, remember that the accounts your provider uses are in scope, and you must be able to show the controls are met.
You have six months from opening an assessment account to complete it, and IASME says assessors aim to mark a submission within about three days. Our certification process page sets out the full route.
Preparing for the question set, and how we help
Free starting points include IASME's question set booklet, the Cyber Essentials Readiness Tool, IASME's Cyber Essentials Knowledge Hub and our own Cyber Essentials checklist. For most organisations, though, the hard part is not reading the questions but discovering which answers are not yet true.
Our gap analysis works through the Danzell questions against your actual devices, tenants and firewalls, fixes what fails, and helps you draft clear answers your assessor can mark first time. To work through the questions with us, contact us.
Explore Question set
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I see the Cyber Essentials questions before I apply?
Yes. IASME publishes the current question set as a free download in PDF and Excel formats. You can read it, draft your answers and fix gaps before opening an assessment account, then enter the final answers in the online portal.
Which Cyber Essentials question set is current?
Danzell, which came into force on 27 April 2026 with the NCSC's Requirements for IT Infrastructure v3.3. It replaced Willow. Accounts opened before that date had six months to finish under Willow, and that window has now closed.
What happens if I answer a question wrongly?
If the assessor finds a non-compliant answer you receive feedback and have two working days to amend your answers free of charge. Some answers, such as missing MFA on a cloud service or critical updates installed late, are automatic fails. After the two days you must reapply and pay again.
Do I have to answer the questions again every year?
Yes. Certificates last 12 months, and at renewal you complete the then-current question set from scratch. Keeping a copy of this year's answers and evidence makes renewal much quicker.
Who signs the Cyber Essentials declaration?
A board member or equivalent senior person. Under Danzell the declaration also accepts responsibility for keeping the organisation compliant throughout the certification period, so the signatory should understand the answers.