Question 1

Who should be present during assessment?

Accepted Answer

Your IT manager or whoever handles security needs to be present throughout. They need admin access to demonstrate configurations and answer technical questions on the spot. If your IT is outsourced, get your MSP on the call.

Question 2

How long do assessments typically take?

Accepted Answer

2-4 hours for CE Plus, depending on scope and how prepared you are. Simple environments with everything ready can finish in under two hours. Missing evidence or complex setups push it to a full afternoon.

Question 3

How long until I get my Cyber Essentials certification?

Accepted Answer

CE Basic (self-assessment questionnaire): 1-3 business days after submission. CE Plus: 3-5 business days after completing any remediation. Need it faster? Fast Track delivers in 12 hours for a £400 premium. Useful when a contract deadline won't move.

Question 4

What if a device is broken/offline during assessment?

Accepted Answer

I'll check a different device from the same category. The assessment needs a representative sample, not every single device. If an entire category is unavailable (all your Macs are offline, for example), I may need to reschedule that portion.

Question 5

How long do I have to fix issues found during assessment?

Accepted Answer

You've got 28 days to remediate any non-conformances found during the CE Plus assessment. That's the standard IASME timeframe. If you need longer, talk to me - I'm flexible for genuine technical challenges. I'll re-test the specific issues at no extra charge.

Question 6

When will I know if I've passed?

Accepted Answer

I'll notify you within 3-5 business days after completing any remediation. Everything passes first time with no non-conformances? Typically within 48 hours. Your IASME certificate is issued digitally and listed on the NCSC's public register.

Question 7

What if I fail? When can I retake?

Accepted Answer

You get a detailed non-conformance report specifying which controls didn't meet requirements. Remediate and re-test within the 28-day window at no extra cost. Need to start fresh because of significant infrastructure changes? I'll discuss the best approach. No penalty or waiting period.

Question 8

What's the difference between 'recommended' and 'required' for MFA under Danzell?

Accepted Answer

Currently (before April 2026), MFA is required for admin and privileged accounts on cloud services. Recommended for everyone else. From April 2026 under Danzell v3.3, MFA becomes required for all cloud service accounts where the service supports it - admin and standard users. Preparing now? Treat it as required already. You need it before April 2026 anyway.

Question 9

How do I prepare staff for potential disruption?

Accepted Answer

Tell staff systems may be briefly inaccessible during technical checks - short periods during the 2-4 hour assessment window. Schedule during a quieter business period if possible. In practice, most staff won't notice anything.

Question 10

What if assessment runs over planned time?

Accepted Answer

I'll finish what needs finishing. No extra charge for going slightly over. If it's running much longer than expected (usually because evidence isn't ready), I'll suggest completing the remaining checks in a follow-up session rather than rushing.

Question 11

Can I schedule assessment for specific time of day?

Accepted Answer

Yes, I'll work around your schedule. Most clients prefer mornings or early afternoons when IT staff are fresh and systems are less busy. Avoid days when you're deploying major updates or running maintenance windows.

Question 12

What if I need to reschedule at short notice?

Accepted Answer

Contact me immediately. Genuine emergencies - illness, system outages, critical business issues - no penalty. Give me as much notice as possible so I can reallocate the slot. Things happen.

Question 13

What's the final check before assessment?

Accepted Answer

48 hours before assessment, verify: all devices patched within 14 days (check Windows Update and third-party software), MFA enabled on every cloud account, firewall enabled on all devices, malware protection active and updated, admin accounts separate from daily-use accounts, and you can log into every admin portal you need to show me. If anything fails this check, you've still got time to fix it.

Question 14

What's the most common compliance failure between assessments?

Accepted Answer

Patch management. Hands down. Organisations fail to keep patches within the 14-day window, especially for third-party software (Adobe, Java, browsers, PDF readers). Windows and macOS auto-updates help but don't cover everything. By renewal time, devices three months behind on patches with nobody noticing. Happens more than you'd think.

Question 15

What's the biggest incident response mistake?

Accepted Answer

Delaying containment to investigate. When you discover a security incident, isolate affected systems immediately. Don't spend hours trying to understand what happened before disconnecting the compromised device. Contain first, investigate second. Every minute of delay during active malware spread or data exfiltration increases the damage.

Question 16

Is it worth paying for accelerated assessment scheduling?

Accepted Answer

Fast Track (12-hour turnaround, £400 premium) is worth it when a contract deadline can't move. Tender closes Friday and you need the certificate by Thursday? The £400 pays for itself instantly. For routine certifications without time pressure, the standard 1-3 day turnaround is fine.

Question 17

What do organisations with smooth assessments do differently?

Accepted Answer

Automated patch management that checks daily and applies updates within 14 days. Centralised tools like Intune or NinjaOne so everything's visible in one dashboard. And a dry run a week before, checking all five control areas themselves before I arrive. The common thread: compliance as ongoing operations, not annual panic.

Question 18

Do social media platforms count?

Accepted Answer

Depends how you use them. Browsing LinkedIn or Facebook from personal accounts? They don't count. But under Danzell v3.3, if staff log into company social media accounts (LinkedIn company page, Twitter/X business account, Facebook business page), those accounts are in scope. MFA must be enabled where the platform supports it.

Question 19

Why do I need compliance monitoring after getting CE certified?

Accepted Answer

CE certification lasts 12 months. Compliance can drift within days if nobody's watching. Staff install unauthorised software, new devices get added without proper configuration, patches slip past the 14-day window, people leave with admin accounts still active. By month six, you could be non-compliant without knowing it. I see it constantly.

Question 20

Is compliance monitoring expensive to implement?

Accepted Answer

Cheaper than failing renewal. Our Cyber 365 Patching service is priced on the scoping call and handles automated patch management with compliance tracking. Already using Microsoft 365 Business Premium? Intune provides basic monitoring at no extra cost. Even a simple spreadsheet tracking patch dates and MFA status, reviewed weekly, is better than nothing.

Question 21

Does Net Sec Group provide compliance monitoring services?

Accepted Answer

Yes. Patching monitors and enforces the 14-day requirement. EDR + Patching adds threat detection with automated isolation. Vulnerability Scanning (priced on the scoping call) provides continuous scanning. All services include reporting that maps directly to CE control areas.

Question 22

Should I provide laptops to contractors?

Accepted Answer

For contractors working more than three months or needing admin access, yes. Full control over security configuration, patches and malware protection, and it's straightforward to demonstrate compliance during assessment. Short-term contractors (under a month)? MDM on their personal device or restricting them to a virtual desktop may be more practical.

Question 23

I just discovered hidden contractors before my assessment. What do I do?

Accepted Answer

Contact me immediately. Two options: postpone the assessment while you bring contractor devices up to CE standard (proper patching, MFA, malware protection), or restructure access so those contractors genuinely don't touch your in-scope systems. Don't try to hide them - if I discover unmanaged contractor access during the screenshare, it's a fail.

Question 24

What happens if vulnerabilities are found during scanning?

Accepted Answer

Depends on severity. Critical vulnerabilities (CVSS 9.0+) are an automatic fail. High vulnerabilities (CVSS 7.0-8.9) fail if the patch has been available for more than 14 days. You get a remediation report detailing each finding, and you've got 28 days to fix the issues and request re-scanning. Most vulnerabilities I find are missing patches that can be applied quickly.

Question 25

What about systems that require scheduled downtime for patching?

Accepted Answer

You still need critical and high-risk patches applied within 14 days, even if the system requires a maintenance window. Weekly maintenance windows give you buffer. Monthly windows don't. If a system genuinely can't be patched within 14 days due to operational requirements, document why and discuss compensating controls with your assessor.

Question 26

Can I get CE certified during cloud migration?

Accepted Answer

Yes, but it's messier. Mid-migration means including both on-premise systems and cloud services in scope - double the evidence gathering. I'd recommend certifying before migration or after completing it. If timing forces a mid-migration assessment, talk to me about handling the transitional scope.

Question 27

How much time should we invest in discovery?

Accepted Answer

Allow 1-2 weeks before starting your CE application. Small businesses (5-20 people) can usually finish discovery in 2-3 days. Larger organisations with multiple departments and unknown shadow IT may need a full week. The time investment pays off - discovering a forgotten SaaS tool during the assessment is far more disruptive than finding it beforehand.

Question 28

How quickly must I respond to maintain CE compliance?

Accepted Answer

CE doesn't specify incident response timeframes, but if an incident compromises your CE controls you need to act fast. Compromised admin credentials or disabled malware protection? Immediate response. Within hours. A phishing attempt that didn't succeed is lower priority. Data breaches involving personal data put you on a 72-hour ICO notification clock.

Question 29

How do I preserve digital evidence during response?

Accepted Answer

Don't power off affected systems - you'll lose RAM contents (running processes, encryption keys, active network connections). Disconnect from the network instead. Take screenshots of error messages, malware alerts and unusual processes. Save system logs before they rotate. Law enforcement and insurers want this evidence intact.

Question 30

What should I tell management during active incidents?

Accepted Answer

Clear, factual updates without technical jargon. Focus on business impact: what's affected, who's impacted, what decisions they need to make (authorise system shutdowns, approve customer notifications, engage legal counsel). Update every 2-4 hours during active incidents, even if the update is 'no change, still investigating.' Don't speculate about cause until you know.

Question 31

What are most common lessons learned from CE incidents?

Accepted Answer

The patterns I see in incidents involving CE-certified businesses: patching was actually behind schedule despite claims otherwise, MFA gaps on forgotten cloud services, admin accounts being used for daily work (violating separation), staff who didn't know who to contact, backup recovery never tested. Almost always the same story: 'we thought we were compliant but hadn't actually checked recently.'

Question 32

Is the discount automatic when I get certified?

Accepted Answer

No. You must notify your insurer and provide your CE certificate. Contact your broker directly, send the IASME certificate PDF, include your policy number, ask them to note the certification on your file. Some insurers apply mid-term adjustments. Others note it for your next renewal.

Question 33

When should I contact insurers about CE certification?

Accepted Answer

The day you receive your certificate. If you're shopping for new insurance, provide the certificate during quoting to get the best rates upfront. Mid-policy? Notify your broker immediately so they can note it for renewal or request a mid-term adjustment. Don't wait until renewal - you'll miss months of potential savings.

Question 34

What's the best update strategy for Mac environments?

Accepted Answer

Under 20 Macs? Enable automatic updates on each machine (System Settings, General, Software Update) and check weekly that nothing's pending past 14 days. Larger deployments need MDM to push updates centrally and track compliance. Apple doesn't publish CVSS scores, so treat all security updates as high priority and apply within 14 days.

Question 35

Are Macs worth the compliance effort?

Accepted Answer

Macs are often easier to certify than Windows. Consistent built-in security: XProtect for malware, Gatekeeper for app control, built-in firewall, FileVault for encryption. The effort is proving compliance to an assessor, which requires either MDM (for CE Plus evidence) or manual verification of each machine. Already on Microsoft 365? Intune manages Macs alongside your Windows devices.

Question 36

How long does MDM deployment take?

Accepted Answer

Small businesses (10-20 devices): allow 1-2 weeks. MDM platform setup takes a couple of days, policy configuration another 2-3 days, then pilot testing before full rollout. 50+ devices: allow 3-4 weeks to account for testing across device types and troubleshooting edge cases. User enrolment itself takes 15-30 minutes per device.

Question 37

It's September 2025 and I haven't started. What do I do?

Accepted Answer

You've got 4-6 weeks before Windows 10 end-of-life. Triage immediately. Run PC Health Check across all devices to identify which can upgrade in-place (do those first, quickest option). Incompatible machines? Order replacements now - hardware lead times eat into your window. If replacements can't arrive in time, consider Microsoft's Extended Security Updates (paid, buys you time) or moving those devices off-scope temporarily.

Question 38

How long does EDR deployment take?

Accepted Answer

For a typical SME with 10-50 devices, allow 1-2 weeks. Day one: console setup and policy configuration. Day two: pilot deployment on 5-10 devices to verify no conflicts. Days 3-5: roll out to remaining devices. Week two: tune alert thresholds and resolve false positives. Our Cyber 365 EDR deployment is managed by me, so your IT team's involvement is minimal.

Question 39

Should we manage EDR internally or use managed services?

Accepted Answer

Managed EDR makes sense for most SMEs. Managing it internally requires dedicated security staff with expertise in threat analysis, 24/7 monitoring, and time to investigate alerts. No security team? Most SMEs don't have one. Managed EDR gives you professional monitoring without the headcount. Our Cyber 365 service (priced on the scoping call) includes full management - you don't touch the console.

Question 40

How quickly can Net Sec Group deploy EDR?

Accepted Answer

Week one: discovery call to understand your environment, then I configure the EDR console and deploy agents to a pilot group. Week two: full rollout to all devices with policy tuning. Most businesses fully protected within 10-14 days. Active threat or urgent deadline? Emergency deployment in 48-72 hours with a compressed pilot phase.

Question 41

Which insurance policies benefit from CE certification?

Accepted Answer

Cyber and data breach insurance benefits most directly. Professional indemnity sometimes offers small reductions (5-10%) because CE reduces data breach risk. Directors and officers liability can benefit if cyber risk is a board concern. General business insurance rarely offers CE-specific discounts, but some underwriters factor it into overall risk scoring.

Question 42

How quickly can I get premium reductions after certification?

Accepted Answer

New policies: discount applies immediately if you provide the CE certificate during quoting. Existing policies: most insurers note it for your next renewal (could be months away). Some apply mid-term adjustments within 2-4 weeks. Ask your broker specifically whether a mid-term change is possible.

Question 43

How do I maintain insurance benefits long-term?

Accepted Answer

Never let your CE certificate expire. If it lapses, insurers may revoke your discount - some may increase your premium at renewal. Renew at least one month before expiry so there's no gap. Keep your insurer updated on security improvements (EDR deployment, incident response plan) and maintain incident-free claims history for the strongest renewal terms.

Question 44

How long does Windows 11 migration take?

Accepted Answer

Small businesses (10-25 devices): 2-4 weeks. Medium businesses (25-100 devices): 4-8 weeks. That covers hardware assessment, procurement of replacement machines, Windows 11 deployment, data migration and user setup. Hardware procurement is the bottleneck (2-3 weeks lead time), not the migration work itself. Start planning at least 3 months before you need it done.

Question 45

What's the most important thing to prepare?

Accepted Answer

Organise evidence by the five controls: firewalls, secure configuration, access control, malware protection, patch management. Have admin access credentials ready for every system in scope so you can show me configurations live. The ones who struggle can't log into their own firewall or don't know which Microsoft 365 admin portal to use.

Question 46

Should I take fresh screenshots or use old ones?

Accepted Answer

I take the screenshots during assessment. Evidence must show controls are presently in place, so old screenshots won't work. Just make sure you can access all admin portals and configuration pages on the day.

Question 47

What evidence do assessors actually want to see?

Accepted Answer

I need to see current configurations across the five CE control areas. That means firewall rules (inbound deny-by-default), patch status (everything within 14 days), MFA settings on cloud accounts, malware protection active on all devices, and user access controls showing separate admin accounts. Prepare admin portal access for everything in scope. I'll walk through it with you during the screenshare.

Question 48

What's the most important factor for assessment success?

Accepted Answer

Actually being compliant before assessment day. Sounds obvious. Many businesses hope to wing it. Run through the five controls a week before: all devices patched within 14 days? Is MFA enabled on every cloud service? Are admin accounts separate from daily-use accounts? Is malware protection active on everything? The assessment verifies what's there. It doesn't fix things for you.

Question 49

Should I brief assessor on our setup beforehand?

Accepted Answer

Send me your scope document and a high-level overview of your infrastructure before the assessment. Helps me understand your environment and prepare relevant checks. Don't overwhelm me with 50-page policy documents. Brief summary of what systems you use and how your network is set up. That's enough.

Question 50

How do we avoid MFA assessment failures?

Accepted Answer

Audit every cloud service with user accounts. Under Danzell, MFA is mandatory on all cloud service accounts where the service supports it. Not just admin accounts. Most common failure: MFA on Microsoft 365 but nothing on the accounting software, CRM, domain registrar, backup service, or social media accounts. List every service, check each one has MFA enabled, and keep screenshots of the MFA configuration page for each.

Cyber Essentials Certification

Can your IT team answer YES to this, with evidence?

Or pick the product that fits your need.

Start free, see where you stand

Cyber Essentials & Cyber Essentials Plus

Cyber 365

What is Cyber Essentials?

Firewalls

Secure Configuration

User Access Control

Malware Protection

Patch Management

What You Get with Certification

£25,000 Cyber Insurance

Government & MOD Contracts

Supply Chain Advantage

Insurance Premium Savings

Digital Certificate

Investor Ready

Get the Official CE Questions

CE vs CE Plus: Which Do You Need?