Blog › Article
The Cyber Essentials questionnaire, section by section
The self-assessment questionnaire looks long, but it follows a simple structure: who you are, what's in scope, then one section for each of the five controls. Knowing what each section is really checking makes it much quicker to answer well.
How it's organised
The questionnaire is grouped into sections labelled A1 to A8. The wording is updated from time to time, so always work from the version your certification body gives you, but the structure is broadly this:
| Section | Covers |
|---|---|
| A1 | Your organisation |
| A2 | Scope of the assessment |
| A3 | Insurance |
| A4 | Firewalls |
| A5 | Secure configuration |
| A6 | Security update management |
| A7 | User access control |
| A8 | Malware protection |
A1 — Your organisation
Who is being certified. Under the current question set this needs to be precise: the legal entities covered, with their names, addresses and company numbers.
A2 — Scope
The section that decides everything else. You describe what's in scope and list devices, operating systems, network equipment and cloud services. Assessors compare this with your later answers, so an unsupported operating system in the list, or a cloud service later missing MFA, will surface here. See Cyber Essentials scope.
A3 — Insurance
Eligibility for the cyber insurance included with the certificate for qualifying UK organisations certifying their whole organisation.
A4 — Firewalls
Your boundary firewall or router, software firewalls on devices that leave the office, default passwords, admin interfaces and inbound rules. Assessors look for a real answer for home workers, not just the office.
A5 — Secure configuration
Unnecessary software and accounts, default passwords, autorun, device locking, and the password and lockout rules. See password and MFA requirements.
A6 — Security update management
Supported, licensed software and the fourteen-day rule. Two questions here are automatic fails: A6.4, for operating systems, routers and firewalls, and A6.5, for applications. See the fourteen-day window in practice.
A7 — User access control
Account processes, least privilege, separate admin accounts, and MFA on cloud services for administrators and users. The MFA questions are automatic fails where a service offers MFA and it isn't enabled.
A8 — Malware protection
Anti-malware or application allow-listing on every device that supports it, kept up to date and configured to block malicious code and websites.
Answering well
- Answer for every in-scope device, not the best one.
- Describe the mechanism, not an intention. "Updates are automatic and checked weekly" is an answer; "we keep things updated" isn't.
- Keep answers consistent with the scope you described in A2.
- Be honest. A board-level director or equivalent signs the declaration that the answers are true.
Quick answers
How long does the questionnaire take?
For a well-prepared small organisation, a day or two. Most of the time goes into finding and fixing what the questions reveal.
Can I save and come back to it?
Certification bodies' portals generally let you work through it over time before submitting.
Which questions are automatic fails?
MFA on cloud services that offer it, for administrators and users, and the fourteen-day update questions, A6.4 and A6.5.