How to Complete the Cyber Essentials Questionnaire

Three things need to be in place before you open the questionnaire.

1. An Assured Service Provider engaged. The VSA isn't completed directly with IASME; you access it through an ASP's portal. Your ASP provides credentials and may offer a readiness review before you start.
2. A defined scope. The questionnaire applies to all in-scope systems. Scope is something you set and agree with your ASP before submitting; changes mid-way can require restarting the submission.
3. Evidence prepared. Configuration exports, firewall rules, and access documentation all need to exist before you submit. Pulling them together mid-session creates errors.

If you haven’t done this preparation work yet, start with the Cyber Essentials Checklist before opening the questionnaire. It lists the specific evidence items required for each of the five controls and will save you re-entering the portal once you realise something is missing.

Scope is one of the most consequential decisions in the process. The in-scope set broadly includes all end-user devices, servers, and cloud services that could affect the security of your data or services if compromised.

Cloud services and home-working devices have been explicitly in scope for some years, and the MFA requirement has tightened in stages: mandatory for cloud administrator accounts from January 2022, then widened to cover every cloud-based user account, not just admins, from 24 April 2023. The scheme has moved on since then: Willow was the version in force from January 2022, and Danzell, effective from 26 April 2026, is the current standard. If you’re preparing a submission now, you’re assessed against Danzell, not Willow, so confirm with your ASP that your scope and evidence reflect the current requirements rather than an older version you may have seen referenced in older guidance.

Two common scope mistakes: (1) scoping too narrowly to avoid failing; (2) including systems that are genuinely isolated and not network-connected. If you’re unsure about a system’s scope status, ask your ASP before you start answering questions, not after.

The questionnaire is organised into five sections, one per control. Each asks you to confirm a specific state of your estate and provide evidence to support it. The detail of why each control matters, and what good practice looks like, is covered in The 5 Cyber Essentials Controls Explained. Below is what each section actually asks you to do in the portal.

Section 1, Firewalls: confirm a boundary firewall (or equivalent) is in place at every network boundary, and that personal firewalls are active and correctly configured on any device that connects to public networks outside your control. - Firewall rule set exports or screenshots showing rules reviewed within the last 12 months - List of all boundary devices and their network segments - Confirmation that default admin passwords have been changed on each device - Documented business justification for any open inbound ports or services.

Section 2, Secure Configuration: confirm unnecessary software, accounts, and functionality have been removed or disabled, and devices are built to a documented secure baseline before deployment. - Device build or hardening standard - Installed software audit for a representative sample of devices - List of removed or disabled default accounts and services - Password policy configuration export.

Section 3, User Access Control: confirm accounts are provisioned through a formal process, access follows least privilege, administrative accounts are restricted and separately authenticated, and MFA is enforced on any account accessible over the internet. - Access control policy document - List of users with administrative privileges and the business reason for each - MFA enforcement configuration screenshots - Joiner, mover, and leaver process documentation.

Section 4, Malware Protection: confirm every in-scope device runs anti-malware software, application allow-listing, or an equivalent control, with automatic updates enabled. - Anti-malware deployment report showing coverage across the in-scope estate - Configuration screenshot showing automatic definition updates enabled - Application allow list, where used instead of anti-malware software.

Section 5, Security Update Management: confirm all software, operating systems, and firmware are licensed, supported, and kept up to date, with high and critical security updates applied within 14 days of release. - Patch management policy and schedule - Patch compliance report covering the last three months across the estate - List of any unsupported software and its remediation or replacement plan.

Common Failure Points by Control

A concrete example is more useful than general advice here, so take a 60-person professional services firm that lets staff use personal laptops and phones instead of issuing corporate devices. Around 40% of staff use a personal device for at least part of their work. How this gets answered in the questionnaire depends entirely on which technical control is actually in place.

If personal devices connect through a virtual desktop. Where the firm routes all corporate data access through a VDI or thin-client service (Azure Virtual Desktop and Citrix are common choices), the personal device never stores or processes organisational data directly. The scope answer would read: “Personal devices used for email and file access connect via [VDI product] only. No organisational data is processed or stored on the personal device itself. Personal devices are therefore out of scope.” Evidence to attach: a VDI architecture diagram, a policy confirming no local storage or split tunnelling, and a configuration export showing clipboard and USB redirection disabled on the session. This last point matters more than most applicants realise: leaving USB redirection or local printing switched on creates a data path back onto the personal device, which pulls it straight back into scope.

If personal devices connect directly. Where staff access Microsoft 365 or Google Workspace natively from a personal phone or laptop, that device is in scope, no argument to be made otherwise. The User Access Control answer then needs to describe real technical enforcement, for example: “All personal devices accessing organisational email and documents are enrolled in Microsoft Intune App Protection Policies. Conditional Access blocks access unless MFA has been completed and the device meets baseline compliance (encryption enabled, supported OS version, screen lock enforced).” Evidence: a conditional access policy export, an MFA enforcement report, and a compliance policy screenshot from the device management console. A written acceptable-use policy telling staff to “use a strong password” is not sufficient evidence against this control, however genuinely it’s followed; the ASP needs to see a technical control enforcing it, not a statement of intent.

Completion time varies by how well-documented your technical estate is. A small organisation with controls in place and evidence ready can get through the questionnaire in a few hours. A mid-market organisation with multiple sites, a diverse device estate, and limited documentation may need several days of IT staff time spread across sessions.

The IASME portal saves progress, so you don't need to complete it in one session. Running a pre-assessment, whether internally or via a readiness tool, before opening the formal submission significantly reduces errors and the total time spent.

If Your Submission Is Approved: the ASP reviews your responses against the CE requirements. Where all five controls are demonstrably in place, a certificate is issued, valid for 12 months, verifiable via NCSC/IASME lookup.

If Your Submission Is Queried or Rejected: where responses don’t satisfy requirements, the ASP raises queries and allows remediation before issuing a formal rejection. Check reassessment terms before you engage an ASP, since these vary between providers.

Next Steps: Cyber Essentials Plus. CE+ is independent technical verification of the same five controls, conducted after the base certificate is issued. The VSA questionnaire is the gateway to CE+.

1. The VSA is completed through an ASP’s portal, not directly with IASME.
2. Scope must be agreed before you start; changing it mid-submission can mean restarting.
3. High and critical security updates must be applied within 14 days.
4. MFA on cloud accounts tightened in stages (admin accounts from January 2022, all accounts from April 2023); the current version applicants are assessed against is Danzell, effective 26 April 2026.
5. A certificate, once issued, is valid for 12 months.
6. The portal saves progress, so completion doesn’t need to happen in one session.