Free download
Cyber Essentials Questionnaire: Self-Assessment Guide and Free Download
The Cyber Essentials questionnaire is the self-assessment you answer in the IASME portal to get certified. It covers your organisation, your scope and the five technical controls. Download our free spreadsheet of the Willow question set to draft answers offline; the portal always uses the current Danzell set.
Updated October 2026 for the Danzell question set (NCSC requirements v3.3).
Cyber Essentials question set: Willow (Excel)
IASME’s Willow question set (April 2025), 93 questions with IASME’s guidance. Free, no sign-up.
Which version is this? Our spreadsheet is IASME’s Willow question set, which applied to assessment accounts opened from 28 April 2025 to 26 April 2026 (accounts opened before 27 April 2026 were given six months to certify on Willow). Assessment accounts opened since then use the Danzell question set. Many of the Danzell changes are clarifications, but some change results (see Willow vs Danzell below), so use the spreadsheet as a drafting aid and check each answer against the current question in the portal. The spreadsheet cannot be imported or uploaded: you enter your answers in the portal, where the current question set always applies. Unsure which set you are being assessed against? Ask us.
Danzell question set: what each section asks
The Danzell question set is the current Cyber Essentials questionnaire. IASME’s booklet (version 16.3, May 2026) has 106 numbered questions in eight sections: your organisation, your scope, insurance, then one section for each of the five technical controls. IASME publishes it free as a PDF or Excel file on its Preview the self-assessment questions page, which is the official, current source. Your final answers go into the IASME portal, where you answer the questions and submit them for marking: the first step to Cyber Essentials certification.
| Section | Questions (Danzell) | Questions (Willow) | What Danzell asks |
|---|---|---|---|
| A1 Your organisation | 23 | 16 | The name of one legal entity for the certificate, organisation type, number of people (including volunteers and contractors with access to your data), registration number, registered and operating addresses, any other legal entities in scope, sector, website and why you are applying. |
| A2 Scope of assessment | 18 | 12 | Whole or partial organisation; for a partial scope, a full scope description, the networks excluded and the firewall or VLAN that separates them; sites, networks, home workers and how they connect; firewalls and routers (make, model and quantity); laptops, desktops, thin clients, servers, tablets and phones (make and operating system version, BYOD included); every cloud service; and who manages your IT. |
| A3 Insurance | 3 | 3 | Eligibility for the included cyber insurance, whether you opt in and a contact email for the policy documents. |
| A4 Firewalls | 14 | 14 | Boundary and software firewalls, default and admin passwords, firewall management and rule reviews, inbound connections and remote access to firewall settings. |
| A5 Secure configuration | 10 | 10 | Removing unused software, services and accounts, changing default passwords, protecting external services, disabling auto-run and locking devices. |
| A6 Security update management | 16 | 16 | Supported and licensed software, your browsers, malware protection, email and office apps, and installing high-risk or critical updates within 14 days. A “no” to A6.4 or A6.5 is an automatic fail. |
| A7 User access control | 17 | 17 | Approving and removing accounts, least privilege, separate admin accounts, password controls and MFA on every cloud service. Missing MFA where a cloud service offers it fails the assessment. |
| A8 Malware protection | 5 | 5 | Whether each device uses anti-malware software, application allow-listing through an app store or code signing, or both. |
Danzell asks for more detail than Willow in the first two sections, mainly legal entities, sub-sets and the networks you exclude. The control sections keep the same structure, with the automatic fails shown above.
What is the Cyber Essentials questionnaire?
It is the set of questions every applicant answers to get Cyber Essentials. You complete it online in the assessment portal, a senior person in your organisation confirms the answers are accurate, and an assessor at a licensed certification body marks it. If every answer meets the requirements, you are certified for 12 months. The same self-assessment is the first stage of Cyber Essentials Plus.
The questions are written by IASME, which runs the scheme for the NCSC, and they map to the NCSC’s Cyber Essentials Requirements for IT Infrastructure v3.3. If you want the rules as a checklist rather than as questions, see our Cyber Essentials requirements and checklist.
How to answer each section
Assessors mark what you write, so answers need to describe what you do today, in enough detail to show how (see how the Cyber Essentials assessment is marked). These are the points that most often trip applicants up in each section.
A1 Your organisation
The name in A1.1 is printed on your certificate (150 characters maximum). Under Danzell it must be a single legal entity, though you can add a trading name. Subsidiaries and other legal entities are listed in A1.6.1 and can be included in the same certification only if they share the same IT infrastructure and network and the board member signing off has authority to represent all of them. Otherwise each needs its own assessment.
A2 Scope of assessment
List make and operating system version for every device type. If you certify a sub-set, the scope needs a clear excluding statement. Under Danzell you also give the name, address and company number of every legal entity in scope and describe any excluded infrastructure. The 300-character limit in the Willow spreadsheet no longer applies: Danzell asks for a fuller scope description, which customers can read on the digital certificate platform. Cloud services cannot be excluded.
A3 Insurance
In the Willow set this depends on a UK or Crown Dependencies head office, turnover under £20m and a whole-organisation scope. Check the current terms on IASME’s website.
A4 Firewalls
Describe the process, not just “yes”: who changes the firewall password, when rules were last reviewed and what was removed.
A5 Secure configuration
Name the controls you actually use, such as MFA on your remote access or account lockout on your customer portal.
A6 Security update management
Give versions for every browser and application listed. The 14-day rule covers operating systems, applications and router and firewall firmware.
A7 User access control
MFA must be on for every user and administrator of every cloud service that offers it. Since April 2026, missing it is an automatic fail.
A8 Malware protection
Most organisations with laptops and phones select both: anti-malware on Windows and macOS, and app-store controls on phones.
Cyber Essentials questions and example questionnaire answers
Four Cyber Essentials questions that often draw weak answers, with a weak and a strong answer to each. A strong answer says what you do, who does it and when.
| Question topic | Weak answer | Strong answer |
|---|---|---|
| Scope for a sub-set (A2) | “Head office.” | “Whole organisation excluding the guest Wi-Fi network, which is on a separate VLAN with no access to company data.” |
| Firewall rule review (A4) | “Yes.” | “Our IT provider reviewed the office firewall rules in March 2026 and removed two unused port forwards. The next review is booked for March 2027.” |
| Removing leavers (A7) | “We remove them.” | “HR emails IT on the leaving date. IT disables the Microsoft 365 account and laptop login that day and checks the user list monthly.” |
| Separate admin accounts (A7) | “Admins are careful.” | “Our two IT staff have separate admin accounts used only for admin tasks. Their everyday accounts have standard user rights and are used for email and browsing.” |
These are illustrations. Your answers must describe your own IT.
Willow vs Danzell: what changed?
Assessment accounts opened from 27 April 2026 use Danzell, based on version 3.3 of the NCSC requirements. IASME’s question set preview page also links IASME’s comparison of the two sets, and IASME’s April 2026 update sets out the changes. The ones that matter most when you move from a Willow draft:
- MFA on cloud services is enforced. Missing MFA on a cloud service that offers it is now an automatic fail.
- The 14-day update rule is an automatic fail. Questions A6.4 (operating systems and router and firewall firmware) and A6.5 (applications, including associated files and extensions) now fail the assessment on their own if high-risk or critical updates are not installed within 14 days of release.
- Cloud services are defined more precisely. v3.3 adds a definition of a cloud service and restates that cloud services cannot be excluded from scope, as under Willow.
- Passwordless sign-in. FIDO2 authenticators such as passkeys are named as passwordless authentication and count as MFA.
- Scope needs more detail, including what is excluded and every legal entity covered.
- Backups get more emphasis. They are recommended but still not required.
The question set changes regularly, usually in April. This history shows which set a past certificate was assessed against:
| Question set | In use from | NCSC requirements version |
|---|---|---|
| Evendine | January 2022 | v3.0 |
| Montpellier | April 2023 | v3.1 |
| Willow | April 2025 | v3.2 |
| Danzell | April 2026 | v3.3 |
Renewing from a Willow certificate? See Cyber Essentials renewal for what to check first.
No question set has been announced for 2027 yet. Our Cyber Essentials 2027 page tracks what IASME and the NCSC confirm, and when.
How many questions are in the Cyber Essentials questionnaire?
IASME’s Danzell booklet has 106 numbered questions across eight sections: 79 main questions and 27 follow-ups, several of which only appear when an earlier answer makes them relevant. Your organisation is the longest section (23), followed by scope (18) and user access control (17). The Willow set in our spreadsheet has 93 (74 main questions and 19 follow-ups); the extra Danzell questions are all in the organisation and scope sections. The count can change with each question set, so treat the portal as the final word.
How to complete the self-assessment
- Agree your scope. Decide whether you are certifying the whole organisation or a separated part. Our Cyber Essentials scope questionnaire helps.
- List your devices and cloud services, with the make and operating system version for each device type, and the make and model of each firewall and router.
- Fix the automatic fails first: MFA on cloud services and updates older than 14 days. Then remove or replace any unsupported software. Our free Cyber Essentials readiness check shows where you stand.
- Draft your answers in the spreadsheet, then enter them in the portal against the current question set.
- Get your answers checked. Every one of our Cyber Essentials packages includes a pre-assessment check and a support call before you submit.
- Submit for assessment. Our guide to getting Cyber Essentials certification covers the common reasons for failing.
If you would rather have an expert work through it with you, see Cyber Essentials consultancy and support.
Gold package: 24-hour assessment
Every package includes a pre-assessment check and a support call of up to an hour with an assessor. Our Gold package adds:
- Assessment within 24 hours (1 working day) of submission to the portal
- Detailed assessment of your responses with feedback on any points of failure
- Unlimited resubmissions and three months to pass
Sovereign Secure is an IASME-licensed Cyber Essentials certification body, so you deal directly with the organisation that issues your certificate, with no reseller in between, and we stay in touch until you pass. See all Cyber Essentials prices.
Additional resources
FAQ
Cyber Essentials questionnaire FAQs
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Is the Cyber Essentials questionnaire free to download?
Yes. Our spreadsheet of IASME’s Willow question set is free with no sign-up. IASME publishes the current Danzell questions free, as a PDF or Excel file, on its Preview the self-assessment questions page.
Which question set is used in 2026?
The Danzell question set, used for assessment accounts opened from 27 April 2026. It is based on version 3.3 of the NCSC Requirements for IT Infrastructure and replaced Willow (v3.2).
What are the new Cyber Essentials requirements for 2026?
Version 3.3 of the NCSC requirements and the Danzell question set apply to accounts opened from 27 April 2026. Missing MFA on a cloud service that offers it and missing the 14-day deadline for high-risk or critical updates are now automatic fails, and the scope questions ask for more detail. Our guide to the Cyber Essentials changes for 2026 explains each one.
How many questions are in the Cyber Essentials questionnaire?
IASME’s Danzell booklet has 106 numbered questions across eight sections, and the Willow set in our spreadsheet has 93. Some only appear if an earlier answer makes them relevant, and the count can change with each question set, so check the current set in the portal.
Which questionnaire sections cover the five controls?
Sections A4 to A8, one for each of the 5 Cyber Essentials controls: firewalls (A4), secure configuration (A5), security update management (A6), user access control (A7) and malware protection (A8); see what the 5 Cyber Essentials controls are for each one in detail.
Is Cyber Essentials hard to pass?
Not if your scope is right, MFA is on for every cloud service and all your software is supported and updated within 14 days. Those are the answers that most often fail. Our guide on how to pass Cyber Essentials first time covers the common failures, and every one of our packages includes a pre-assessment check before you submit.
Can I upload the spreadsheet to the assessment portal?
No. The spreadsheet is a drafting aid only. You enter your answers in the portal, which always shows the current question set.
Who should complete the questionnaire?
Someone who knows your IT well, usually with help from your IT provider. The person named as responsible for your IT must be a member of your organisation, not an employee of an outsourced IT provider.
Are there model answers I can copy?
No. Each answer must describe your own IT as it is on the day you submit. The guidance on this page shows what a strong answer includes, and every one of our packages includes a pre-assessment check of your answers.
What happens after I submit?
An assessor reviews your answers and either certifies you or asks for clarification. With us, Gold submissions are assessed within one working day, Silver within two and Bronze within three to five. See Cyber Essentials cost.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]