Before you start your self-assessment: a preparation checklist

The self-assessment is much easier when you have done the groundwork. This checklist follows the order the NCSC itself suggests, and adds the practical steps that save time once you open the questions.

1. Get the free materials

The NCSC’s resources page lists several free helpers:

• the Requirements for IT Infrastructure document, currently version 3.3, effective from 27 April 2026
• a free copy of the assessment questions, to help you understand them, spot gaps and take notes before you use the assessment portal, which you can download from IASME
• the Cyber Essentials Readiness Tool, which gives tailored guidance on implementing the controls
• access to NCSC-assured Cyber Advisors, and on the overview page a free 30-minute consultation for small and medium-sized organisations

Read the questions once all the way through before you answer anything.

2. Choose your route

The NCSC describes two routes. In the self-led route you register through IASME, pay, then complete the verified self-assessment, which a board member or equivalent signs off and an assessor marks. In the supported route, a certification body licensed by IASME helps you understand the questions and how they apply to your business. Decide which suits your confidence and time.

3. Decide your scope

The requirements say that the first thing to do is establish the boundary of your scope and then work out what is inside it. Define the business unit, the network boundary and the physical location, and agree the scope with the certification body before the assessment begins.

Remember the firm rules: end-user devices must be in scope and cloud services cannot be excluded. Our guide to what is in scope has the detail.

4. Build a list of what you own

The document says asset management is not itself a Cyber Essentials control, but that good asset management helps you meet all five. It should mean accurate information that you actually use, not lists that gather dust. Record:

• every laptop, desktop, tablet and phone that touches business data, including personal devices
• servers, routers and firewalls
• cloud services and the accounts used with them
• accounts used by suppliers or managed service providers

5. Check the controls, one at a time

Firewalls

Is a correctly configured firewall active on every device in scope? Have default administrator passwords on routers and firewalls been changed, and has administrator access from the internet been blocked or properly protected? Are laptops that join public wifi using a software firewall?

Secure configuration

Have you removed or disabled unneeded accounts and software, and changed default passwords? Do devices lock, and require a PIN, password or biometric to unlock? For unlock credentials only, the document says a minimum length of six characters, with protection against repeated guessing.

Security updates

Is everything licensed and supported, with automatic updates on where possible? Can you apply critical and high risk fixes within 14 days? See the 14-day rule and unsupported software.

User access control

Is there a process to create, approve and remove accounts? Does everyone have a unique login? Do administrators have a separate account used only for administration? Is MFA on for all cloud services? See MFA for cloud services.

For passwords, the document sets out options, including a minimum length of 12 characters with no maximum, or eight characters plus a deny list of common passwords, unless MFA protects the account. It advises against enforcing regular password expiry and complexity rules, and encourages a password manager.

Malware protection

Is anti-malware software, or application allow listing, active on every device in scope and kept up to date?

6. Think about backups

The document says backing up is not a technical requirement of Cyber Essentials, but it highly recommends it. If you back up to a USB drive or external hard drive, disconnect it when a backup is not running.

7. Check your suppliers

Where a supplier or contractor manages part of your systems, you must be able to confirm that the controls are met, and show it in your answers. Ask them now rather than during the assessment.

7a. Check your own people

The document asks you to support users in choosing unique passwords for work accounts. That means telling people to avoid common passwords such as a pet’s name or a keyboard pattern, encouraging longer passwords made of several words, and giving them somewhere usable to store passwords, such as a password manager. A short briefing before you start is enough to set this up, and it makes the password answers straightforward.

8. Line up your sign-off

In the self-led route, a board member or equivalent signs off your answers. Tell that person early, and make time for them to read through what you have written.

9. Gather evidence as you go

You might be asked for evidence before the certification body can award certification. Screenshots of settings, exports of device lists and notes on decisions make answers faster and more accurate.

In short

Download the free materials, choose your route, settle your scope, list your assets and check each control before you start. Do not forget backups, suppliers and the person who signs off. The preparation takes longer than the form.

How Vigil CE helps

Vigil CE turns this checklist into a guided plan for your own business. You work through scope, assets and the five controls in order, keep your evidence next to each answer, and open the question set already knowing what you will say.