The certificate arrives as a PDF and goes straight to work. The logo goes on the website footer and into the email signature. A copy goes into the tender folder. Then the renewal reminder lands, gets forwarded to whoever arranged it last time, and comes back done. Nobody in the business has read the answers behind it, because nobody was ever sent them.
The short answer is that Cyber Essentials is a self-assessment. The NCSC publishes the requirements, IASME publishes the questions, and your organisation answers them. The certificate summarises the answers submitted in your business’s name on the day they went in. The answers are the substance. They exist as a completed questionnaire, and you can ask for a copy of it.
None of that makes the certificate meaningless. It describes a set of technical requirements met at a point in time, which is a real thing to hold and a reasonable thing to be asked for. The gap worth closing sits between holding it and having read it. Start with the section saying which people and which devices were counted as in scope, because every other answer rests on it.
What does the certificate actually say about your business?
It says a named organisation answered the scheme’s questions, and that the answers met the requirements when they were submitted. It is a statement about answers. There is no engineer walking round your office counting laptops.
In most small businesses the questions get answered by whoever runs the IT, and that is a sensible division of labour. They are technical questions about how machines and accounts are set up and kept up to date. An owner would not enjoy them and would not be quicker at them. So the answers get written, submitted and accepted, and the only document that reaches the business is the certificate at the end.
We have not seen anyone outside a business ask to read the answers behind a certificate. People ask whether you hold it. That leaves the only likely reader of what your business said about itself sitting inside your business.
Which people and devices are in scope for Cyber Essentials?
Scope decides who and what the rest of the answers were about, and the rule for personal devices is specific. User-owned devices are in scope when they access organisational data or services. Devices used only for native voice, native text and multi-factor authentication apps are explicitly out of scope. That comes from the NCSC’s Cyber Essentials Requirements for IT Infrastructure, version 3.3, April 2026.
A personal laptop that opens work email is in scope. A personal phone that only makes calls, sends texts and shows a login code is out. The line sits at organisational data, so the useful question is what your people actually do on their own machines. That includes the ones who are not on the payroll.
We close that gap one of three ways, and this is our approach rather than something the standard prescribes. Enrol the device in management, so its update state is visible and can be enforced. Issue a company device and keep personal kit out of the work. Or the work sits with a contractor or a bookkeeper on their own equipment, under their own certification.
The in-scope section of your questionnaire should describe the people and devices you actually have, whichever route you took.
What does the 14-day update rule actually require?
It is narrower than most people remember. An update has to be installed within 14 days when the vendor rates it critical or high risk, when it carries a CVSS v3 base score of 7 or above (CVSS is the standard severity score for a vulnerability, running from 0 to 10), or when the vendor gives no severity rating at all. Installing everything within 14 days is strongly recommended in the requirements, and it is not mandatory. All of that is NCSC v3.3, April 2026.
IASME’s April 2026 change note for the Danzell question set made security update management an automatic fail. Answers there that do not meet the requirement fail the assessment outright.
We would add one thing of our own, and the standard does not say it. A policy is not a control. The requirements document uses the word policy once in twenty-six pages, and it is talking about access. What the assessment asks is whether the update landed on the machine, inside the window.
Written rules have real uses. They tell people what is expected, and most changes in behaviour start with one. A rule saying staff should keep their laptops up to date still does not install anything.
How do we get a copy of the answers given in our name?
The completed questionnaire exists as a document. Whoever submitted it has a copy, and so does the certification body. Collecting it is a filing job, and nobody needs to treat it as a confrontation. There is one thing to collect: the completed questionnaire submitted under your business’s name, with the date on it.
Read the in-scope section first. It tells you which people and which devices the other answers were about, and it is the part most likely to have drifted since it was written. Read the security update management answers second, because that is the one now capable of failing an assessment on its own.
Then put it with the company’s records, and note the date it went in and who answered it.
Most of the time it will read fine. That is the ordinary outcome and it is worth having, because you get to say so yourself instead of taking it on trust.
What we find when we ask who was counted
We run a discovery call before we quote for anything, and certification comes up on most of them. The same shape keeps appearing. The business holds a current certificate. We ask how people actually work, and it turns out most of the workforce was using its own computers with no technical controls on them at all: no managed updates, nothing enforcing how the machines were set up, nothing visible from the business’s side. We ask who completed the questionnaire, and it was the provider. We ask whether the directors saw the answers, and they did not.
Nothing dramatic has happened in these businesses. Nobody set out to mislead anyone. The questions are technical, somebody competent answered them, and the certificate came back. What is missing every time is a director who has read what the business said about itself.
A policy says what should happen on a device. A control is what actually happened on it. Every answer in the questionnaire describes one or the other, and the in-scope section tells you which devices were being described.
Put the completed questionnaire in your own files and read the in-scope section first. It is a statement your business made about itself, and it should have at least one reader inside the business.
Quick answers
Our staff use their own laptops. Does that stop us certifying?
No. User-owned devices are allowed, and they come into scope the moment they touch organisational data or services, which means the requirements apply to them like any company machine. The count is where it usually goes wrong. Second laptops and home desktops are easy to leave off a list nobody has written down.
Should we just install every update within 14 days?
Probably, and the requirements strongly recommend it without making it mandatory. Sorting critical and high-risk updates from the rest, per vendor, every month, is more work than installing all of them. The mandatory part is narrower: critical or high risk by the vendor’s rating, a CVSS v3 base score of 7 or above, or no severity given at all.
What if we read the answers and something is not right?
Then you know something you did not know an hour before. The certificate describes a position at the point of submission, and businesses move: new starters, new laptops, a change of provider, somebody working from home three days a week. Write down what has changed and put it in front of whoever handles your certification well before the next renewal.
Who in the business should read the questionnaire?
A director or the owner. The person who filled it in already knows what it says. It takes ten minutes and needs no technical knowledge for the part that matters: whether the description of your people and your devices matches the business you recognise. Anything that does not match is worth a note.
Related reading
- What goes in an AI usage policy for a small business?
- Who owns your Microsoft 365 tenant and domain name?
- Managed IT support for small businesses
If you would like any help or advice, get in touch today!
