Cyber Essentials

Cyber Essentials Guides

Cyber Essentials certification guides, scheme updates, control requirements, and preparation advice for UK businesses.

Can Your CE Basic Certificate Be Revoked? What Happens When You Fail CE Plus Under Danzell

Under Danzell, failing the CE Plus second sample scan can revoke your CE Basic certificate too. Here is how revocation works, what it costs, and how to prevent it.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus First-Time Pass: What Danzell Actually Requires

Under Danzell, CE Plus scans must pass first time. No remediation during the assessment. Here is the double sampling process, what triggers it, and how to prepare.

8 min read

Read Guide

Cyber Essentials

Why RMM Scanners and Windows Defender Will Fail Your Cyber Essentials Plus Assessment

RMM tools and Windows Defender are not approved for CE Plus internal vulnerability scans. Here is what the assessment actually requires and why your IT provider's scanner will miss critical vulnerabilities.

7 min read

Read Guide

Cyber Essentials

Willow to Danzell: What to Do If You Have an Open Cyber Essentials Account

IASME retires the Willow question set on 27 April 2026. If you have an open Willow account, here are the deadlines, what happens if you miss them, and what to do next.

8 min read

Read Guide

Cyber Essentials

How Long Does a Cyber Essentials Plus Assessment Take?

CE Plus testing takes 1-3 days depending on your sample size. But the timeline starts at basic CE and has mandatory windows you can't compress.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Process: What Actually Happens

Five test cases, a sampling methodology, and a 30-day remediation window. Here's what the CE Plus assessment covers and what to expect.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Sample Sizes: How Many Devices Get Tested?

CE Plus doesn't test every device. The IASME sampling table determines how many from each OS build, with servers always tested. Here's how the calculation works.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Second Sample Rule: What Happens When Your First Scan Fails

The cyber essentials plus second sample rule means a failed scan triggers a second random sample. One 30-day window covers both. Here is how it works.

10 min read

Read Guide

Cyber Essentials

How to Prepare for Cyber Essentials Plus: What to Do Before the Assessor Arrives

Practical CE Plus preparation from a Lead Assessor. Run your own scans, check MFA works, verify patches on every device, and get your evidence ready.

14 min read

Read Guide

Cyber Essentials

What Happens If You Fail Cyber Essentials Plus?

What actually happens when a CE Plus assessment finds problems, what the remediation window looks like, and how double sampling works under Danzell.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials FAQ Database: 327 Questions Answered

Complete Cyber Essentials FAQ covering technical requirements, CE Plus, cloud services, MFA, BYOD, costs, and common failures. Written by a CREST-registered assessor.

109 min read

Read Guide

Cyber Essentials

Backup and Recovery: What Cyber Essentials Does and Does Not Require

Cyber Essentials does not require backups. But a ransomware attack without them turns a bad day into a business-ending event. Here is how to think about it.

7 min read

Read Guide

Cyber Essentials

How to Verify a Cyber Essentials Certificate Is Genuine

How to check if a Cyber Essentials certificate is real, current, and covers the right scope. The IASME register and what to look for.

4 min read

Read Guide

Cyber Essentials

Cyber Essentials Certification Guide: What It Is, What It Costs, and How to Get It

The complete guide to Cyber Essentials certification in the UK. Five controls, two levels, one assessment process. Written by an assessor who's certified over 800 businesses.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials with Legacy Systems: How to Get Certified Without Replacing Everything

How to achieve CE certification when you have unsupported operating systems, legacy applications, or equipment that can't be updated. Sub-scoping, compensating controls, and what assessors actually accept.

5 min read

Read Guide

Cyber Essentials

How to Display the Cyber Essentials Logo Correctly

Where to put the CE badge on your website, email signatures, and documents. What you can and can't do with the logo, and why the verification link matters.

4 min read

Read Guide

Cyber Essentials

Cyber Essentials Marking Scheme: How Your Assessment Is Actually Scored

Four outcomes, a two-strike rule, and assessors who cross-reference every answer. Here's how the CE marking scheme works and what trips people up.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials Password Requirements Under Danzell

What CE requires for passwords and authentication under the Danzell update. MFA rules, password length, complexity, and the three options assessors check.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Remote Testing: How It Works

Most CE Plus assessments run remotely now. Here's what the assessor needs, how they verify real devices, and when an on-site visit still makes sense.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Remote Working: Controls for Distributed Teams

Home routers become boundary firewalls. Personal phones become in-scope devices. Here's how to implement CE controls when your team works from everywhere.

6 min read

Read Guide

Cyber Essentials

User Access Control Implementation for Cyber Essentials

How to implement the access control requirements for CE. Admin account separation, MFA, least privilege, and the practical steps that pass assessment.

5 min read

Read Guide

Cyber Essentials

Why Danzell Makes Cyber Essentials Plus Worth Having

Danzell CE+ with whole-org scope, fortnightly scanning, and fortnightly patching is the first time CE has delivered genuine security. This article makes the case.

17 min read

Read Guide

Cyber Essentials

Danzell Readiness Checklist: Are You Ready for CE v3.3?

A practical checklist covering every change you need to make before the Danzell question set takes effect on 27 April 2026.

10 min read

Read Guide

Cyber Essentials

DNS Filtering for Cyber Essentials: Does It Count?

DNS filtering is not a Cyber Essentials requirement, but it strengthens your browser security controls and helps block malicious content before it loads.

7 min read

Read Guide

Cyber Essentials

MFA Edge Cases for Cyber Essentials: What Counts and What Doesn't

Email verification, IP restrictions, Windows Hello, service accounts, shared logins, and session timeouts. Which ones actually satisfy the MFA requirement under v3.3.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Vulnerability Scanning: What Gets Scanned, What Fails, and How to Prepare

CE Plus includes internal and external vulnerability scanning by the assessor. This guide covers what devices get scanned, what the assessor looks for, common failure causes, and how to prepare.

7 min read

Read Guide

Cyber Essentials

Windows 10 End of Life and Cyber Essentials: What It Means If You Haven't Upgraded

Windows 10 support ended 14 October 2025. If you're still running it without Extended Security Updates, you're already failing Cyber Essentials. Here's what to do.

9 min read

Read Guide

Cyber Essentials

How Long Does Cyber Essentials Take? Realistic Timelines from an Assessor

Honest timelines for CE Basic and CE Plus from an assessor who's certified 800+ businesses. Preparation, assessment, and certification timescales.

5 min read

Read Guide

Cyber Essentials

IASME Certification Process: How Cyber Essentials Assessment Works

IASME is the sole delivery partner for Cyber Essentials. Here's how the certification process works from application to certificate, for both Basic and Plus.

6 min read

Read Guide

Cyber Essentials

Lancaster University Cyber Essentials Study: What the Evidence Actually Says

200 vulnerabilities tested against CE's five controls. 131 fully mitigated, 60 partially mitigated, 9 unmitigated. Here's what that means for your business.

5 min read

Read Guide

Cyber Essentials

MDM for Cyber Essentials: When It Is Worth It and How to Deploy

MDM is not a Cyber Essentials requirement. But for organisations with more than about 30 mobile devices, it makes compliance easier to prove and maintain.

8 min read

Read Guide

Cyber Essentials

NCSC Iran Checklist vs Cyber Essentials: Quick-Reference Comparison

Every NCSC recommendation from the Iran cyber advisory mapped against CE controls. What overlaps, what doesn't, and what you need beyond CE.

4 min read

Read Guide

Cyber Essentials

NCSC Iran Cyber Warning: What UK Businesses Should Do

The NCSC Iran cyber warning maps to Cyber Essentials controls. 149 DDoS attacks logged in 72 hours. Here's your action checklist.

8 min read

Read Guide

Cyber Essentials

Network Segmentation for Cyber Essentials: What You Actually Need

Network segmentation is not a Cyber Essentials requirement, but it changes what falls in scope. Here is how segmentation affects your assessment.

5 min read

Read Guide

Cyber Essentials

Our Cyber Essentials Plus Methodology: How We Run the Assessment

External scans, internal authenticated testing, EICAR verification, MFA checks, and account separation. Here's exactly how we conduct CE Plus assessments.

6 min read

Read Guide

Cyber Essentials

Password Managers and Cyber Essentials: What You Need to Know

Password managers help meet the CE password requirements. Here is how they fit into the User Access Control section and what the assessor expects.

5 min read

Read Guide

Cyber Essentials

Qilin Ransomware and the NHS: How Five Controls Could Have Closed the Front Door

Qilin disrupted NHS blood tests for six months. Their attack used techniques Cyber Essentials is designed to stop. Here's the full kill chain.

9 min read

Read Guide

Cyber Essentials

RDP Security: What CE Assessors Find and How to Fix It

Remote Desktop Protocol exposed to the internet is one of the most common CE failures. Here is what to check and how to secure it.

7 min read

Read Guide

Cyber Essentials

SMBv1: Why It Needs Disabling for Cyber Essentials

SMBv1 is the protocol WannaCry used. It should be disabled on every machine. Here is how to check and how to fix it.

7 min read

Read Guide

Cyber Essentials

TLS 1.0 and 1.1: Why They Need Disabling for CE

TLS 1.0 and 1.1 are deprecated protocols with known weaknesses. Here is how to check if they are still enabled and how to disable them.

7 min read

Read Guide

Cyber Essentials

WinTrust Certificate Padding Check: What It Is and How to Enable It

The WinTrust registry setting prevents tampered executables from appearing legitimate. Here is why CE assessors check it and how to enable it.

7 min read

Read Guide

Cyber Essentials

Security Awareness Training: What Actually Changes Behaviour

Annual slideshows don't stop phishing. Here is what a CE assessor sees working, and what he sees failing, across 800+ certifications.

9 min read

Read Guide

Cyber Essentials

What Vulnerability Scans Find That Auto-Updates Miss

Auto-updates miss third-party applications entirely, and built-in RMM scanners don't catch what an assessor's dedicated scanner finds.

8 min read

Read Guide

Cyber Essentials

Wireless Security and Cyber Essentials: What the Assessment Covers

Your Wi-Fi network is in scope for Cyber Essentials. Here is what the requirements actually say about wireless security and what catches people out.

7 min read

Read Guide

Cyber Essentials

BYOD and Cyber Essentials: What's in Scope and What to Do About It

When personal devices are in scope for Cyber Essentials, what the exceptions are, and practical approaches to BYOD compliance under Danzell.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials 30-Day Preparation Plan

A week-by-week plan to prepare for Cyber Essentials certification. What to fix first, what takes longest, and how to avoid last-minute scrambles.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials BYOD Policy: Which Personal Devices Are in Scope Under Danzell

A practical cyber essentials BYOD policy guide. Learn which personal devices fall in scope under Danzell v3.3, what's excluded, and how to classify them.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Checklist 2026: Full Control-by-Control Guide for Danzell

A printable, control-by-control checklist for passing Cyber Essentials under the Danzell question set from 27 April 2026. Organised by scope, patching, MFA, firewalls, malware protection, secure configuration, and evidence.

12 min read

Read Guide

Cyber Essentials

The Most Common Cyber Essentials Failures (and How to Avoid Them)

The failure patterns that come up in assessment after assessment. What causes them, how to spot them before your assessor does, and how to fix them.

10 min read

Read Guide

Cyber Essentials

The Five Cyber Essentials Controls: A Technical Guide

What each of the five Cyber Essentials controls actually requires. Specific settings, thresholds, and configuration details for IT managers.

8 min read

Read Guide

Cyber Essentials

Cyber Essentials for Startups: What You Actually Need

What startups need to know about Cyber Essentials. The five controls, what's in scope when you're small, and why early certification makes contract wins easier.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials FAQ: The Questions Businesses Actually Ask

Straight answers to the Cyber Essentials questions that come up most often, from scope and cost to MFA, patching, BYOD, and what happens when you fail.

10 min read

Read Guide

Cyber Essentials

Malware Protection for Cyber Essentials: What You Need

What the Cyber Essentials malware protection control actually requires. What counts, what doesn't, and the configuration mistakes that cause failures.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials for Multi-Site Businesses: One Certificate or Many?

How to handle Cyber Essentials when your business has multiple offices. Scope, networking, consistency, and whether you need separate certificates per site.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Guide: What the Assessor Tests and How to Pass

CE Plus is a hands-on technical audit of your systems. Here is exactly what happens, what gets tested, and what you need to do to pass first time.

16 min read

Read Guide

Cyber Essentials

CE Plus vs CE Basic: What's the Difference?

Self-assessment vs technical audit. What each Cyber Essentials level involves, what it costs, and which one your business actually needs.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Renewal: What You Need to Know

How the Cyber Essentials renewal process works, when to start preparing, what changes between assessments, and the most common reasons organisations fail at renewal.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Scope Changes Under Danzell: What's Now In Scope

Danzell v3.3 changes what falls in scope for Cyber Essentials. Cloud services can't be excluded, partial scope needs justification, and two qualifiers have been removed from the scope criteria.

11 min read

Read Guide

Cyber Essentials

Shared Admin Accounts and Cyber Essentials: Why They Fail and How to Fix Them

Shared admin accounts are one of the most common Cyber Essentials failures. Here's what the requirement says, why shared accounts fail, and how to restructure them.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Timeline: How Long Certification Takes in 2026

Realistic timelines for Cyber Essentials and CE Plus certification. How long each stage takes, what affects the timeline, and how to avoid delays.

10 min read

Read Guide

Cyber Essentials

Windows 365 and Contractor Devices: What's in Scope for Cyber Essentials?

How Windows 365 Cloud PCs, contractor devices, and virtual desktops fit into your Cyber Essentials scope. What counts, what doesn't, and where it gets complicated.

10 min read

Read Guide

Cyber Essentials

Danzell vs Willow: What Actually Changed in Cyber Essentials

Side-by-side comparison of Willow v3.2 and Danzell v3.3 Cyber Essentials requirements. Same five controls. Different scope, definitions, and enforcement.

10 min read

Read Guide

Cyber Essentials

Failed Cyber Essentials? Here's What to Do Next

What actually happens after a failed CE assessment, why most failures are fixable in days, and how to pass on your next attempt.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Day: What to Expect and How to Prepare

A CE Plus assessment is a technical audit of your systems by an accredited assessor. Here's what happens on the day, what you need to prepare, and what catches people out.

9 min read

Read Guide

Cyber Essentials

Cloud Migration and Cyber Essentials: How Moving to the Cloud Changes Your Scope

Moving from on-premise to cloud changes your Cyber Essentials scope in ways most businesses don't expect. Here's what shifts, what stays the same, and where the shared responsibility model trips people up.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Cloud Service Inventory: How to Find Everything in Scope

Under Danzell, cloud services can't be excluded from your Cyber Essentials scope. Here's how to find every cloud service your business uses, and what the assessor checks.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Compliance Monitoring: Staying Compliant Between Assessments

CE certification lasts 12 months, but compliance can drift in weeks. Here is what to check quarterly and what to fix before renewal.

8 min read

Read Guide

Cyber Essentials

Contractor Devices and Cyber Essentials: When Are They in Scope?

Contractor laptops accessing your systems are in scope for Cyber Essentials. Here is what controls apply, what options you have, and how to handle the common edge cases.

8 min read

Read Guide

Cyber Essentials

Cyber Essentials and Incident Response: What the Scheme Covers (and What It Doesn't)

CE doesn't require an incident response plan. But when a breach happens during your certification year, your controls are the first thing that gets checked.

7 min read

Read Guide

Cyber Essentials

macOS and Cyber Essentials: What Mac Users Need to Know

Macs aren't exempt from Cyber Essentials. Here's how macOS handles each of the five controls, what assessors check, and where Mac environments commonly fail.

8 min read

Read Guide

Cyber Essentials

Mobile Device App Allowlisting for Cyber Essentials: What You Actually Need

Which mobile devices are in scope for Cyber Essentials, what app controls apply, and how to manage application installation without expensive MDM.

8 min read

Read Guide

Cyber Essentials

Firewalls and Antivirus for Cyber Essentials: What's Required

The specific firewall and antivirus requirements for Cyber Essentials. What settings you need, what products work, and where the assessment catches people out.

10 min read

Read Guide

Cyber Essentials

How Do You Know If You're Ready for Cyber Essentials?

A practical readiness check for Cyber Essentials covering all five controls. What to verify before your assessment so you don't waste time or money.

10 min read

Read Guide

Cyber Essentials

Linux Firewall Configuration for Cyber Essentials

How to configure iptables, nftables, or UFW to meet the CE firewall control. What the assessor checks and how to document it.

8 min read

Read Guide

Cyber Essentials

macOS Firewall Configuration for Cyber Essentials

How to configure the macOS firewall and security settings to meet the CE firewall control. What the assessor checks and how to document it.

5 min read

Read Guide

Cyber Essentials

MFA on Cloud Services for Cyber Essentials: What v3.3 Requires

Version 3.3 makes MFA mandatory on all cloud services with no scope exclusions. Here is what the requirement says, which services it covers, and what counts as MFA.

10 min read

Read Guide

Cyber Essentials

Mobile Device Protection for Cyber Essentials

What Cyber Essentials actually requires for phones and tablets. The requirements are simpler than most people think.

7 min read

Read Guide

Cyber Essentials

Passwordless Authentication and Cyber Essentials: What Counts Under Danzell

How passkeys, FIDO2 keys, and biometrics fit into Cyber Essentials under v3.3. What satisfies the MFA requirement and what doesn't.

9 min read

Read Guide

Cyber Essentials

Local Admin Rights: Why They Fail CE and How to Fix It

Local admin access is one of the most common Cyber Essentials failures. Here is what we find and how to restrict it properly.

6 min read

Read Guide

Cyber Essentials

PowerShell Execution Policies: What CE Assessors Check

An unrestricted PowerShell execution policy is a CE Plus failure. Here is what the assessor looks for and how to set the right policy.

6 min read

Read Guide

Cyber Essentials

Software Security Code of Practice: What Changed in Cyber Essentials v3.3

Version 3.3 replaces the OWASP ASVS reference with the UK government's Software Security Code of Practice. Here is what changed, what it means for your CE assessment, and whether you need to act.

7 min read

Read Guide

Cyber Essentials

Unsupported Software and Cyber Essentials: What to Do When You Can't Update

What happens when in-scope software reaches end of life. The CE rules, your options when you can't update, and how to handle legacy systems during assessment.

10 min read

Read Guide

Cyber Essentials

Windows 11 Hardening for Cyber Essentials: Settings That Actually Fail Assessments

Windows 11 defaults won't pass a Cyber Essentials assessment. Autoplay, admin accounts, firewall exceptions, and patch deferral all need fixing. Here's what to change.

10 min read

Read Guide

Cyber Essentials

Windows Defender Configuration for Cyber Essentials

Windows Defender meets the CE malware protection control when configured properly. Here is what the assessor checks and how to set it up.

6 min read

Read Guide

Cyber Essentials

Windows Firewall Configuration for Cyber Essentials

How to configure Windows Defender Firewall to meet the CE firewall control. PowerShell commands, Group Policy settings, and what the assessor checks.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials 14-Day Patching: What the Requirement Actually Says and How to Meet It

The Cyber Essentials 14-day patching rule applies to vulnerabilities scored CVSS 7.0 or above, or described by the vendor as critical or high risk. This guide explains the requirement, what counts as a fix, and how to build a process that keeps you compliant.

11 min read

Read Guide

Cyber Essentials

Cyber Essentials v3.3: What the Danzell Update Changes and What You Need to Do

The Danzell update to Cyber Essentials takes effect 27 April 2026. Here is what actually changed in v3.3, what it means for your business, and how to prepare.

15 min read

Read Guide

Other categories

21 guides

Penetration Testing →

36 guides

Business & Sector →

23 guides

Research & Intelligence →