Work Through the Steps
Confirm the Route and Version
Cyber Essentials uses a verified self-assessment; Cyber Essentials Plus adds independent technical testing of the same five control areas. Confirm which route your customer or tender needs. Record the requirements and question-set versions for your application. NCSC currently publishes requirements v3.3, effective from 27 April 2026; IASME identifies Danzell for purchases from that date. Use the official documents to prepare your answers.
Reconcile the Scope
Bring together your business activities, locations, end-user devices, servers, network boundaries and cloud services. Check remote work, personal devices used for business and outsourced IT with the people responsible for them. Cloud services holding or processing organisational data or services cannot simply be left out. Agree uncertain boundaries with the certification body before assessment, and make the device and service records consistent with that decision.
Build an Evidence Plan
Use the worksheet to assign preparation work across firewall protection, device configuration, software updates, account access and malware defences. For each area, record who can explain the current setup and where supporting evidence is held. Reference approved records rather than copying passwords, personal device details or raw security results into a widely shared spreadsheet. Mark anything untested or unclear as an open action.
Fix Gaps and Check Again
Give each unresolved issue an action owner. The organisation or its IT provider makes the change, then someone checks the resulting state and updates the evidence reference. Write answers about what is operating now. An intention to enable a control, a screenshot from last year or a provider's general assurance should not be recorded as a verified current fact. Keep unresolved items visible to the person approving the submission.
Prepare the Submission and Testing
Have the senior signatory review the proposed answers and outstanding questions before the declaration is signed. Submit through the official assessment platform, where the assessor reviews the application. For CE+, confirm that its scope matches the CE certificate, agree testing access and responsibilities, and arrange for the audit to be completed within three months of CE certification. Confirm the exact deadline with the certification body. Retain the result and follow-up actions for continuing control operation and renewal.
Fictional Example: Linden Design
Linden Design Ltd is preparing a new CE application. Its staff work remotely using business laptops, mobile devices and cloud collaboration services.
- Scope Check
- The operations manager and IT provider are reconciling device records and business cloud accounts, including personal devices used for business.
- Open Action
- A departed user's cloud account is still active. The IT provider must remove access that is no longer needed, then verify and record the outcome with the operations manager.
- Evidence Reference
- The planner links to a restricted account-review record, rather than storing credentials or a complete user export.
- Submission Decision
- The signatory reviews the corrected evidence and remaining questions before approving the answers. The worksheet itself does not award a pass.
Watch For
- Reusing last year's answers without checking the current estate and scheme version.
- Treating a provider's general statement as evidence of your own configuration.
- Booking CE+ without checking the assessment window and practical testing access.
Your Next Step
Confirm your application versions, complete the scope row, then agree evidence owners and resolve the first open action.