Understand the assurance you are being asked for
NCSC's Cyber Essentials overview describes a scheme addressing five technical areas: firewalls, secure configuration, security updates, user access and malware protection. The scheme provides a focused starting point for protection against common cyber threats. It does not establish compliance with every privacy or industry regulation.
There are two assurance levels. Cyber Essentials uses an assessed self-assessment. Cyber Essentials Plus adds technical testing. Before purchasing an assessment, check which level a prospective customer or contract asks for and which part of your organization must be covered.
Use the official certification route
IASME is the scheme's delivery partner. Its resources describe certification routes and provide access to certification bodies. Use the current question set and scope instructions supplied through that route. Assessment versions can change, so an old completed questionnaire is not a reliable substitute for the current application.
Prepare an evidence conversation
Start with a list of the services and systems included in your intended scope. Identify who can answer technical questions and who can approve the organization's responses. Ask the certification body how outsourced services, remote working and organizational boundaries should be represented for your circumstances.
Keep the scope statement, chosen assurance level and assessment instructions together. When comparing offers, check whether they cover preparation assistance, assessment, technical testing or some combination of those services. Confirm renewal arrangements and the expiry of any existing certificate directly with the scheme provider. The downloadable checklist records these preparation questions; it is not a certificate or an exhaustive technical assessment.