Cyber Essentials self-assessment questions: what to prepare

What the self-assessment actually is

Cyber Essentials is a self-assessed certification. You answer the questionnaire yourself, and a qualified assessor at an IASME-licensed Certification Body marks your answers against the requirements. There is no audit of your systems at this level — that is Cyber Essentials Plus, which adds an independent technical audit on top of the same self-assessment.

Two things follow from that. Your answers are taken at face value, so they need to describe what is genuinely in place. And because they are marked rather than negotiated, an answer that does not meet the requirement comes back for correction, which costs you time you had not planned for.

Since 27 April 2026 the question set is called Danzell, replacing Willow, and the underlying requirements are v3.3. If you are renewing and reaching for last year’s saved answers, that date is the one to check first.

What each part asks about, and who in your business holds the answer

The table below maps the assessment to the information it needs from you. The third column is the one worth reading closely. Preparation is usually described as a technical task, but look at where the answers actually live: a director, an IT provider, HR, finance. That is the real reason a questionnaire you could answer in an afternoon takes a fortnight.

If you want this as something to work through and tick off, the Cyber Essentials checklist covers the same ground as a printable list with owner and status columns.

What separates an answer that passes from one that comes back

Assessors are not looking for polished writing. They are checking whether the arrangement you describe meets the requirement, for everybody it needs to cover. Four things distinguish answers that clear that bar:

• It covers everyone, not the case you thought of first. “We have multi-factor authentication” and “multi-factor authentication is enabled for every user of this service” are different statements, and only the second one answers the question. The same gap appears with devices: the answer describes the company laptops and quietly omits the two people using their own.
• It describes today, not the plan. Work that is scheduled for next month is not in place. Answering as though it were converts a gap you could have closed into a correction after marking.
• It is specific about the arrangement.“We patch regularly” does not engage with the requirement; “critical and high-risk updates are applied within 14 days, checked monthly by our IT provider” does.
• Somebody could check it. If the answer rests on memory rather than a list, a setting or a record, it will not survive the follow-up question.

When the honest answer is no

Every organisation preparing for the first time finds something it does not yet do. That is what preparation is for, and finding it before submission is the good outcome rather than the bad one.

The temptation is to answer optimistically — to say yes because the fix is easy and somebody will get to it. It rarely works out cheaper, and there is a specific reason why. The certification fee includes one free resubmission if you do not pass first time. After that, another failed attempt means paying the fee again.

So an optimistic answer is not free. It spends the one correction you were given, on something you already knew about, and leaves you with none in hand for the thing you genuinely missed. Close the gap, then answer yes. If closing it will take longer than the time you have, that is a scheduling conversation, not a wording one.

Where preparation usually stalls

Across the five controls, the same four things account for most of the delay. None of them are difficult. All of them take longer than a day because they need somebody else.

1. The cloud services list. The list held by whoever manages IT and the list of services actually in use are almost never the same. Departmental sign-ups, tools attached to a personal login, and anything inherited from a previous supplier all belong on it.
2. Personally owned devices. A personal phone used to check work email is in scope for the controls that apply to it. Deciding that personal devices may not reach organisational data is a legitimate answer — provided it is genuinely enforced rather than merely stated.
3. The leaver process. Most organisations have one. Fewer can point to it running for the last person who left, which is the form the question effectively takes.
4. Software past end of life. This one cannot be patched into compliance, because the updates no longer exist. It needs replacing or removing from scope, and both take planning.

Why this guide does not list the questions

The Danzell question set belongs to IASME, and it is not ours to republish. IASME publishes its own preview of the self-assessment questions, linked at the foot of this page, and that preview is the version that stays current when the question set changes — as it did on 27 April 2026.

There is a practical reason as well as a licensing one. A copied question list goes stale the day the set is updated, and a business preparing against a stale copy is doing the one thing this guide exists to prevent. What does not go stale is the information you need to have gathered, and who in your organisation holds it.