87 Expert Guides

Pass Cyber Essentials First Time

The complete library: 87 guides on CE preparation, technical controls, assessment process, and common failures

Cyber Essentials is a UK government-backed certification that demonstrates your business meets a baseline of cybersecurity controls. This is the complete guide library — 87 in-depth articles covering every aspect of preparation, assessment, and common pitfalls. Use the sections below to find exactly what you need, whether you are starting from scratch, preparing for CE Plus, or recovering from a failed assessment.

All Guides in This Library

BYOD and Cyber Essentials: What's in Scope and What to Do About ItWhen personal devices are in scope for Cyber Essentials, what the exceptions are, and practical approaches to BYOD compliance under Danzell.
Backup and Recovery: What Cyber Essentials Does and Does Not RequireCyber Essentials does not require backups. But a ransomware attack without them turns a bad day into a business-ending event. Here is how to think abo
CE Plus vs CE Basic: What's the Difference?Self-assessment vs technical audit. What each Cyber Essentials level involves, what it costs, and which one your business actually needs.
Can Your CE Basic Certificate Be Revoked? What Happens When You Fail CE Plus Under DanzellUnder Danzell, failing the CE Plus second sample scan can revoke your CE Basic certificate too. Here is how revocation works, what it costs, and how t
Cloud Migration and Cyber Essentials: How Moving to the Cloud Changes Your ScopeMoving from on-premise to cloud changes your Cyber Essentials scope in ways most businesses don't expect. Here's what shifts, what stays the same, and
Contractor Devices and Cyber Essentials: When Are They in Scope?Contractor laptops accessing your systems are in scope for Cyber Essentials. Here is what controls apply, what options you have, and how to handle the
Cyber Essentials 14-Day Patching: What the Requirement Actually Says and How to Meet ItThe Cyber Essentials 14-day patching rule applies to vulnerabilities scored CVSS 7.0 or above, or described by the vendor as critical or high risk. Th
Cyber Essentials 30-Day Preparation PlanA week-by-week plan to prepare for Cyber Essentials certification. What to fix first, what takes longest, and how to avoid last-minute scrambles.
Cyber Essentials BYOD Policy: Which Personal Devices Are in Scope Under DanzellA practical cyber essentials BYOD policy guide. Learn which personal devices fall in scope under Danzell v3.3, what's excluded, and how to classify th
Cyber Essentials Certification Guide: What It Is, What It Costs, and How to Get ItThe complete guide to Cyber Essentials certification in the UK. Five controls, two levels, one assessment process. Written by an assessor who's certif
Cyber Essentials Checklist 2026: Full Control-by-Control Guide for DanzellA printable, control-by-control checklist for passing Cyber Essentials under the Danzell question set from 27 April 2026. Organised by scope, patching
Cyber Essentials Cloud Service Inventory: How to Find Everything in ScopeUnder Danzell, cloud services can't be excluded from your Cyber Essentials scope. Here's how to find every cloud service your business uses, and what
Cyber Essentials Compliance Monitoring: Staying Compliant Between AssessmentsCE certification lasts 12 months, but compliance can drift in weeks. Here is what to check quarterly and what to fix before renewal.
Cyber Essentials FAQ Database: 327 Questions AnsweredComplete Cyber Essentials FAQ covering technical requirements, CE Plus, cloud services, MFA, BYOD, costs, and common failures. Written by a CREST-regi
Cyber Essentials FAQ: The Questions Businesses Actually AskStraight answers to the Cyber Essentials questions that come up most often, from scope and cost to MFA, patching, BYOD, and what happens when you fail
Cyber Essentials Marking Scheme: How Your Assessment Is Actually ScoredFour outcomes, a two-strike rule, and assessors who cross-reference every answer. Here's how the CE marking scheme works and what trips people up.
Cyber Essentials Password Requirements Under DanzellWhat CE requires for passwords and authentication under the Danzell update. MFA rules, password length, complexity, and the three options assessors ch
Cyber Essentials Plus Assessment Day: What to Expect and How to PrepareA CE Plus assessment is a technical audit of your systems by an accredited assessor. Here's what happens on the day, what you need to prepare, and wha
Cyber Essentials Plus Assessment Guide: What the Assessor Tests and How to PassCE Plus is a hands-on technical audit of your systems. Here is exactly what happens, what gets tested, and what you need to do to pass first time.
Cyber Essentials Plus Assessment Process: What Actually HappensFive test cases, a sampling methodology, and a 30-day remediation window. Here's what the CE Plus assessment covers and what to expect.
Cyber Essentials Plus First-Time Pass: What Danzell Actually RequiresUnder Danzell, CE Plus scans must pass first time. No remediation during the assessment. Here is the double sampling process, what triggers it, and ho
Cyber Essentials Plus Remote Testing: How It WorksMost CE Plus assessments run remotely now. Here's what the assessor needs, how they verify real devices, and when an on-site visit still makes sense.
Cyber Essentials Plus Sample Sizes: How Many Devices Get Tested?CE Plus doesn't test every device. The IASME sampling table determines how many from each OS build, with servers always tested. Here's how the calcula
Cyber Essentials Plus Second Sample Rule: What Happens When Your First Scan FailsThe cyber essentials plus second sample rule means a failed scan triggers a second random sample. One 30-day window covers both. Here is how it works.
Cyber Essentials Plus Vulnerability Scanning: What Gets Scanned, What Fails, and How to PrepareCE Plus includes internal and external vulnerability scanning by the assessor. This guide covers what devices get scanned, what the assessor looks for
Cyber Essentials Remote Working: Controls for Distributed TeamsHome routers become boundary firewalls. Personal phones become in-scope devices. Here's how to implement CE controls when your team works from everywh
Cyber Essentials Renewal: What You Need to KnowHow the Cyber Essentials renewal process works, when to start preparing, what changes between assessments, and the most common reasons organisations f
Cyber Essentials Scope Changes Under Danzell: What's Now In ScopeDanzell v3.3 changes what falls in scope for Cyber Essentials. Cloud services can't be excluded, partial scope needs justification, and two qualifiers
Cyber Essentials Timeline: How Long Certification Takes in 2026Realistic timelines for Cyber Essentials and CE Plus certification. How long each stage takes, what affects the timeline, and how to avoid delays.
Cyber Essentials and Incident Response: What the Scheme Covers (and What It Doesn't)CE doesn't require an incident response plan. But when a breach happens during your certification year, your controls are the first thing that gets ch
Cyber Essentials for Multi-Site Businesses: One Certificate or Many?How to handle Cyber Essentials when your business has multiple offices. Scope, networking, consistency, and whether you need separate certificates per
Cyber Essentials for Startups: What You Actually NeedWhat startups need to know about Cyber Essentials. The five controls, what's in scope when you're small, and why early certification makes contract wi
Cyber Essentials v3.3: What the Danzell Update Changes and What You Need to DoThe Danzell update to Cyber Essentials takes effect 27 April 2026. Here is what actually changed in v3.3, what it means for your business, and how to
Cyber Essentials with Legacy Systems: How to Get Certified Without Replacing EverythingHow to achieve CE certification when you have unsupported operating systems, legacy applications, or equipment that can't be updated. Sub-scoping, com
DNS Filtering for Cyber Essentials: Does It Count?DNS filtering is not a Cyber Essentials requirement, but it strengthens your browser security controls and helps block malicious content before it loa
Danzell Readiness Checklist: Are You Ready for CE v3.3?A practical checklist covering every change you need to make before the Danzell question set takes effect on 27 April 2026.
Danzell vs Willow: What Actually Changed in Cyber EssentialsSide-by-side comparison of Willow v3.2 and Danzell v3.3 Cyber Essentials requirements. Same five controls. Different scope, definitions, and enforceme
Failed Cyber Essentials? Here's What to Do NextWhat actually happens after a failed CE assessment, why most failures are fixable in days, and how to pass on your next attempt.
Firewalls and Antivirus for Cyber Essentials: What's RequiredThe specific firewall and antivirus requirements for Cyber Essentials. What settings you need, what products work, and where the assessment catches pe
How Do You Know If You're Ready for Cyber Essentials?A practical readiness check for Cyber Essentials covering all five controls. What to verify before your assessment so you don't waste time or money.
How Long Does Cyber Essentials Take? Realistic Timelines from an AssessorHonest timelines for CE Basic and CE Plus from an assessor who's certified 800+ businesses. Preparation, assessment, and certification timescales.
How Long Does a Cyber Essentials Plus Assessment Take?CE Plus testing takes 1-3 days depending on your sample size. But the timeline starts at basic CE and has mandatory windows you can't compress.
How to Display the Cyber Essentials Logo CorrectlyWhere to put the CE badge on your website, email signatures, and documents. What you can and can't do with the logo, and why the verification link mat
How to Prepare for Cyber Essentials Plus: What to Do Before the Assessor ArrivesPractical CE Plus preparation from a Lead Assessor. Run your own scans, check MFA works, verify patches on every device, and get your evidence ready.
How to Verify a Cyber Essentials Certificate Is GenuineHow to check if a Cyber Essentials certificate is real, current, and covers the right scope. The IASME register and what to look for.
IASME Certification Process: How Cyber Essentials Assessment WorksIASME is the sole delivery partner for Cyber Essentials. Here's how the certification process works from application to certificate, for both Basic an
Lancaster University Cyber Essentials Study: What the Evidence Actually Says200 vulnerabilities tested against CE's five controls. 131 fully mitigated, 60 partially mitigated, 9 unmitigated. Here's what that means for your bus
Linux Firewall Configuration for Cyber EssentialsHow to configure iptables, nftables, or UFW to meet the CE firewall control. What the assessor checks and how to document it.
Local Admin Rights: Why They Fail CE and How to Fix ItLocal admin access is one of the most common Cyber Essentials failures. Here is what we find and how to restrict it properly.
MDM for Cyber Essentials: When It Is Worth It and How to DeployMDM is not a Cyber Essentials requirement. But for organisations with more than about 30 mobile devices, it makes compliance easier to prove and maint
MFA Edge Cases for Cyber Essentials: What Counts and What Doesn'tEmail verification, IP restrictions, Windows Hello, service accounts, shared logins, and session timeouts. Which ones actually satisfy the MFA require
MFA on Cloud Services for Cyber Essentials: What v3.3 RequiresVersion 3.3 makes MFA mandatory on all cloud services with no scope exclusions. Here is what the requirement says, which services it covers, and what
Malware Protection for Cyber Essentials: What You NeedWhat the Cyber Essentials malware protection control actually requires. What counts, what doesn't, and the configuration mistakes that cause failures.
Mobile Device App Allowlisting for Cyber Essentials: What You Actually NeedWhich mobile devices are in scope for Cyber Essentials, what app controls apply, and how to manage application installation without expensive MDM.
Mobile Device Protection for Cyber EssentialsWhat Cyber Essentials actually requires for phones and tablets. The requirements are simpler than most people think.
NCSC Iran Checklist vs Cyber Essentials: Quick-Reference ComparisonEvery NCSC recommendation from the Iran cyber advisory mapped against CE controls. What overlaps, what doesn't, and what you need beyond CE.
NCSC Iran Cyber Warning: What UK Businesses Should DoThe NCSC Iran cyber warning maps to Cyber Essentials controls. 149 DDoS attacks logged in 72 hours. Here's your action checklist.
Network Segmentation for Cyber Essentials: What You Actually NeedNetwork segmentation is not a Cyber Essentials requirement, but it changes what falls in scope. Here is how segmentation affects your assessment.
Our Cyber Essentials Plus Methodology: How We Run the AssessmentExternal scans, internal authenticated testing, EICAR verification, MFA checks, and account separation. Here's exactly how we conduct CE Plus assessme
Password Managers and Cyber Essentials: What You Need to KnowPassword managers help meet the CE password requirements. Here is how they fit into the User Access Control section and what the assessor expects.
Passwordless Authentication and Cyber Essentials: What Counts Under DanzellHow passkeys, FIDO2 keys, and biometrics fit into Cyber Essentials under v3.3. What satisfies the MFA requirement and what doesn't.
PowerShell Execution Policies: What CE Assessors CheckAn unrestricted PowerShell execution policy is a CE Plus failure. Here is what the assessor looks for and how to set the right policy.
Qilin Ransomware and the NHS: How Five Controls Could Have Closed the Front DoorQilin disrupted NHS blood tests for six months. Their attack used techniques Cyber Essentials is designed to stop. Here's the full kill chain.
RDP Security: What CE Assessors Find and How to Fix ItRemote Desktop Protocol exposed to the internet is one of the most common CE failures. Here is what to check and how to secure it.
SMBv1: Why It Needs Disabling for Cyber EssentialsSMBv1 is the protocol WannaCry used. It should be disabled on every machine. Here is how to check and how to fix it.
Security Awareness Training: What Actually Changes BehaviourAnnual slideshows don't stop phishing. Here is what a CE assessor sees working, and what he sees failing, across 800+ certifications.
Shared Admin Accounts and Cyber Essentials: Why They Fail and How to Fix ThemShared admin accounts are one of the most common Cyber Essentials failures. Here's what the requirement says, why shared accounts fail, and how to res
Software Security Code of Practice: What Changed in Cyber Essentials v3.3Version 3.3 replaces the OWASP ASVS reference with the UK government's Software Security Code of Practice. Here is what changed, what it means for you
TLS 1.0 and 1.1: Why They Need Disabling for CETLS 1.0 and 1.1 are deprecated protocols with known weaknesses. Here is how to check if they are still enabled and how to disable them.
The Five Cyber Essentials Controls: A Technical GuideWhat each of the five Cyber Essentials controls actually requires. Specific settings, thresholds, and configuration details for IT managers.
The Most Common Cyber Essentials Failures (and How to Avoid Them)The failure patterns that come up in assessment after assessment. What causes them, how to spot them before your assessor does, and how to fix them.
Unsupported Software and Cyber Essentials: What to Do When You Can't UpdateWhat happens when in-scope software reaches end of life. The CE rules, your options when you can't update, and how to handle legacy systems during ass
User Access Control Implementation for Cyber EssentialsHow to implement the access control requirements for CE. Admin account separation, MFA, least privilege, and the practical steps that pass assessment.
What Happens If You Fail Cyber Essentials Plus?What actually happens when a CE Plus assessment finds problems, what the remediation window looks like, and how double sampling works under Danzell.
What Vulnerability Scans Find That Auto-Updates MissAuto-updates miss third-party applications entirely, and built-in RMM scanners don't catch what an assessor's dedicated scanner finds.
Why Danzell Makes Cyber Essentials Plus Worth HavingDanzell CE+ with whole-org scope, fortnightly scanning, and fortnightly patching is the first time CE has delivered genuine security. This article mak
Why RMM Scanners and Windows Defender Will Fail Your Cyber Essentials Plus AssessmentRMM tools and Windows Defender are not approved for CE Plus internal vulnerability scans. Here is what the assessment actually requires and why your I
Willow to Danzell: What to Do If You Have an Open Cyber Essentials AccountIASME retires the Willow question set on 27 April 2026. If you have an open Willow account, here are the deadlines, what happens if you miss them, and
WinTrust Certificate Padding Check: What It Is and How to Enable ItThe WinTrust registry setting prevents tampered executables from appearing legitimate. Here is why CE assessors check it and how to enable it.
Windows 10 End of Life and Cyber Essentials: What It Means If You Haven't UpgradedWindows 10 support ended 14 October 2025. If you're still running it without Extended Security Updates, you're already failing Cyber Essentials. Here'
Windows 11 Hardening for Cyber Essentials: Settings That Actually Fail AssessmentsWindows 11 defaults won't pass a Cyber Essentials assessment. Autoplay, admin accounts, firewall exceptions, and patch deferral all need fixing. Here'
Windows 365 and Contractor Devices: What's in Scope for Cyber Essentials?How Windows 365 Cloud PCs, contractor devices, and virtual desktops fit into your Cyber Essentials scope. What counts, what doesn't, and where it gets
Windows Defender Configuration for Cyber EssentialsWindows Defender meets the CE malware protection control when configured properly. Here is what the assessor checks and how to set it up.
Windows Firewall Configuration for Cyber EssentialsHow to configure Windows Defender Firewall to meet the CE firewall control. PowerShell commands, Group Policy settings, and what the assessor checks.
Wireless Security and Cyber Essentials: What the Assessment CoversYour Wi-Fi network is in scope for Cyber Essentials. Here is what the requirements actually say about wireless security and what catches people out.
macOS Firewall Configuration for Cyber EssentialsHow to configure the macOS firewall and security settings to meet the CE firewall control. What the assessor checks and how to document it.
macOS and Cyber Essentials: What Mac Users Need to KnowMacs aren't exempt from Cyber Essentials. Here's how macOS handles each of the five controls, what assessors check, and where Mac environments commonl

Ready to Get Started?

Skip the research and talk to an expert. Our lead assessor has worked with 800+ UK organisations.