Scope the environment
Identify devices, services, cloud accounts, users and the legal entity being certified
01 / Self-Assessment Certification
A Defensible Security Baseline
Cyber Essentials helps organisations demonstrate the essential technical protections in a defined environment.
Prepare accurate responses
Address each Danzell question using your real configuration and operating practices
Complete verification
Submit the senior-approved questionnaire for independent assessment
The assessment route and certification decision are governed by the current scheme requirements.
02 / Find Your Route
Choose the Assurance Your Organisation Actually Needs
Some organisations need a verified baseline for procurement. Others need Plus technical testing. NCSC Cyber Advisor support helps implement controls but is a separate service from independent certification assessment.
Cyber Essentials
Verified self-assessment against the five controls
Discuss this certification route ↗Cyber Essentials Plus
Independent technical audit following Cyber Essentials
Discuss this certification route ↗NCSC Cyber Advisor
Practical help implementing the technical controls, whether or not certification is immediately required
FeatureCyber EssentialsCyber Essentials Plus
Five technical controlsYesYes
Verified self-assessmentYesYes
Independent technical testingNoYes
Valid for12 months12 months
03 / The Five Controls01 / TECHNICAL CONTROL 02 / TECHNICAL CONTROL 03 / TECHNICAL CONTROL 04 / TECHNICAL CONTROL 05 / TECHNICAL CONTROL
Five Essential Controls One Clear Security Baseline
All Cyber Essentials assessments cover these five security themes, and the Plus assessment checks their practical operation on the in-scope infrastructure.
Firewalls
Control traffic and protect the boundary of your devices and networks
Secure Configuration
Remove unnecessary services and insecure defaults
Security Update Management
Keep operating systems, applications and other software securely updated
User Access Control
Apply least privilege and strong authentication, including MFA
Malware Protection
Limit the execution and impact of malicious code
04 / Scheme Update
Danzell 2026 What Has Changed
IASME's Danzell question set applies to assessment accounts created from 27 April 2026, alongside NCSC Requirements for IT Infrastructure v3.3. The most consequential changes concern mandatory MFA and timely installation of high-risk or critical updates.
Current scope and marking rules should be checked before an assessment, particularly for hybrid and cloud environments.
Review the official questions ↗Danzell question set
Applies to assessment accounts created from 27 April 2026, alongside Requirements for IT Infrastructure v3.3
Cloud MFA
Where a cloud service offers MFA, failure to enable it is an automatic-fail condition
Security updates
Critical and high-risk security updates must be applied within 14 days, with automatic-fail marking for key questions
Cloud and scope
Relevant cloud services remain in scope and must not be excluded simply because they are hosted externally
05 / Assessment Method
A Defined Route From Preparation to Certification
The most efficient assessment follows the real systems and scheme requirements, not a generic questionnaire checklist.
01
Confirm the legal entity and assessment scope
Understand the compliance or contract requirement and the actual security environment.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
02
Review devices, cloud services and users
Confirm the relevant systems, users, services and responsibilities.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
03
Prepare the Danzell self-assessment
Review the controls and gather credible current-state information.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
04
Address MFA and update-management issues
Work through technical or evidence gaps with the responsible teams.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
05
Submit verified answers for independent assessment
Carry out the agreed assessment or technical assurance route.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
06
Plan the annual renewal
Document outcomes and prepare for ongoing control maintenance.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
06 / Practical Readiness
Understand the Scope Before You Submit
Certification boundaries must reflect the organisation and its real technology, including relevant cloud services and user access. NCSC Cyber Advisor support can help teams make changes before an independent certification assessment.
2-sec / CONTROL WORKSPACEFrom scope to
01 FirewallsREVIEW 02 Secure ConfigurationREVIEW 03 Security Update ManagementREVIEW 04 User Access ControlREVIEW Illustrative assessment planning, not a certification result
From scope to
control evidence
07 / Independent CredentialsIASME APPROVAL NCSC ASSURANCE
Two Distinct Credentials One Practical Route to Readiness
2-sec reports both IASME approval as a Cyber Essentials Certification Body and assurance as an NCSC Cyber Advisor service provider. They address different jobs and should not be confused.
Cyber Essentials Certification Body
An approved Certification Body assesses the Cyber Essentials requirements and can issue certification where scheme criteria have been met.
Cyber Advisor Assured Service Provider
Cyber Advisors provide practical implementation advice and hands-on support for the five technical controls. Advice and certification assessment are distinct roles.
The NCSC Cyber Advisor scheme is operated through IASME as delivery partner. The service-provider designation should match 2-sec's current official scheme listing.
08 / What Happens NextBASELINE HIGHER ASSURANCE IMPLEMENTATION HELP
Start With the Requirement Not a Bigger Project
Tell 2-sec what you need certification for, when it is required and which systems are in scope. A suitable route can then be discussed.
Cyber Essentials
Verified self-assessment and annual renewal
Cyber Essentials Plus
Independent technical testing of the same five controls
NCSC Cyber Advisor
Practical assistance with technical control configuration
09 / Buyer Questions
Cyber Essentials Questions Answered Clearly
Understand the current scheme and the distinction between certification assessment and technical implementation support.
Is Cyber Essentials a self-assessment?
Yes. Applicants answer the IASME questionnaire, with responses approved by an authorised senior representative and independently assessed.
Which question set applies now?
Danzell and NCSC Requirements for IT Infrastructure v3.3 apply to assessments created from 27 April 2026.
Does my cloud environment count?
Relevant cloud services and user accounts are within the current scheme scope; outsourced hosting is not an automatic exemption.
What if MFA is not enabled?
If a cloud service offers MFA, not implementing it is an automatic-fail condition under the current marking rules.
How long is certification valid?
Cyber Essentials certification is valid for 12 months and must be renewed.
Can 2-sec help implement the controls?
As an NCSC-assured Cyber Advisor provider, 2-sec can support practical implementation of the five controls. Certification assessment is a separate role governed by scheme rules.
10 / Your Next Move
Choose Your Next Step With Confidence
Discuss your certification requirements, in-scope systems and practical readiness with 2-sec.