Cyber Essentials preparation checklist

Start with the current requirements

Cyber Essentials covers five technical control areas. Both certification levels address those controls; Plus adds independent technical testing. The NCSC scheme overview explains the distinction. This planning guide does not reproduce the assessment or establish that your organisation meets it.

Download the applicable question set and requirements from IASME’s preparation resources. Check the version that applies to your purchase date. Use the official documents to resolve technical requirements, rather than relying on an old completed questionnaire.

Prepare answers your business can stand behind

Bring the business owner, the person managing IT and any external provider into the discussion. Separate what you know from what still needs checking. A useful preparation meeting ends with a short action list, not a collection of optimistic yes answers.

Keep evidence references in your own business records. A reference can identify an inventory, policy or agreed change without copying sensitive configurations into this checklist. Agree how an assessor or support provider will receive any further information.

Bring this to your next conversation

Your practical checklist

Tick a row when you have recorded an answer and any follow-up. These ticks are planning notes, not a pass mark. They stay on this page and are not saved or sent.

Review owner: ____________________

Review date: ____________________

Confirm the reason and deadlineIs this a first application, renewal or customer requirement? Record the requested certificate, organisation name, deadline and the person who can clarify the requirement.
Owner / evidence / next action:
Agree the scopeList sites, remote staff, devices, cloud services and any proposed exclusions. Ask the assessor how the current requirements apply before assuming an item is outside scope.
Owner / evidence / next action:
Build a current inventoryAsk who maintains the device and software list. Include operating-system versions, business applications and the owner responsible for confirming support and update status.
Owner / evidence / next action:
Assign the five control areasFor firewalls, secure configuration, security updates, access control and malware protection, name the person who can explain the setup and supply an accurate answer.
Owner / evidence / next action:
Include outsourced responsibilitiesAsk your MSP and cloud administrators which controls they manage, what they can confirm in writing and which decisions or changes remain your responsibility.
Owner / evidence / next action:
Turn unknowns into actionsRecord gaps, missing information and planned changes separately. Give each an owner and target date; confirm completion before treating an intended change as an implemented control.
Owner / evidence / next action:
Check the commercial scopeAsk which fees cover assessment, preparation, remediation and any retest. Confirm the certification body, what evidence is needed and who signs off the organisation’s answers.
Owner / evidence / next action:

Need help preparing?

A Cyber Essentials support enquiry goes directly to Dead Simple Computing. Enquiring is free and carries no obligation; preparation, remediation and certification work is quoted separately. You can also compare other security providers and agree your own assessment route.

Cyber Essentials preparation checklist

Start with the current requirements

Prepare answers your business can stand behind

Your practical checklist

Need help preparing?

Useful for your team or customers?