Cyber Essentials v3.3

Cyber Essentials, for how you actually run.

For a firm that already has PCI DSS and is now asked for Cyber Essentials by a customer or a framework, and for software firms that run on a cloud. The platform shows where you stand on each of the five controls before you apply.

Applies to Requirements v3.3 (April 2026), Danzell question setLast checked 11 Oct 2026

Ask for a walkthrough

Normatiq is not a certification body. Cyber Essentials certificates are issued only by certification bodies licensed by IASME, the NCSC's delivery partner.

Readiness by control · Cyber Essentials v3.3Example

Firewalls1 inbound rule with no recorded approvalNot in place

Secure ConfigurationNo unused accounts foundIn place

Security Update Management2 servers with a critical update older than 14 daysNot in place

User Access ControlMFA on for every user and administratorIn place

Malware ProtectionNeeds evidence from youNot checked

The five controls, as the scheme names them2 in place · 2 not in place · 1 not checked

The scheme

Know where the scheme stands.

Cyber Essentials is a UK government-backed scheme with five technical controls. The platform checks your cloud accounts against them and shows where you stand on each.

On Amazon Web Services, Microsoft Azure, Google Cloud and Alibaba Cloud. It observes configuration. It does not alter it.

Where the scheme stands11 Oct 2026

Requirements: v3.3, in force since 27 April 2026
Question set: Danzell
A certificate lasts: 12 months
Who certifies you: A certification body licensed by IASME, the NCSC's delivery partner. Not Normatiq

The five controls

Which controls are still your job?

You are always responsible for every control. User Access Control is yours on every kind of cloud service.

Control	What it asks for	Infrastructure as a service	Platform as a service	Software as a service
Firewalls	Every device in scope sits behind a correctly set up firewall, and inbound rules are approved and written down.	You and the provider	The provider, sometimes also you	The provider
Secure Configuration	Unneeded accounts and software are removed, default passwords are changed and devices lock.	You and the provider	You and the provider	You and the provider
Security Update Management	Software is licensed and supported, and critical and high-risk updates (patching) are applied within 14 days.	You and the provider	You and the provider	The provider
User Access Control	Administrators use separate accounts, every user has their own, and multi-factor authentication (MFA) is on wherever it is offered.	You	You	You
Malware Protection	An active mechanism runs on every device in scope.	You and the provider	The provider, sometimes also you	The provider

The last three columns restate Table 1 of the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3, which says who typically implements each control. Contains public sector information licensed under the Open Government Licence v3.0.

No room for judgement

Three rules with no margin.

Most questions leave an assessor some room. These three do not, and all three can be checked from evidence before you apply.

The rule	What fails an application	Questions
MFA on every cloud service that offers it	It is not switched on for every user and every administrator.	A7.16, A7.17
Critical and high-risk updates within 14 days	A critical or high-risk fix is older than 14 days, on an operating system, router or firewall firmware, or other software.	A6.4, A6.5
No unsupported software in scope	IASME says that with unsupported software in scope there is no certificate.	A6.1

How certification works

You apply. A certification body certifies.

Normatiq prepares you. It is not part of the scheme.

The scheme offers free help of its own: the Cyber Essentials Readiness Tool and the question set.

How certification worksCyber Essentials

You: Answer the question set, and a board member or equivalent signs a declaration that the answers are true
An assessor: At a certification body, marks your answers
Cyber Essentials Plus: Adds a technical audit by a certification body, within three months of your certificate

If you already have PCI DSS

Already have PCI DSS? What differs.

The two are assessed separately, and holding one does not give you the other.

Subject	PCI DSS	Cyber Essentials
Scope	The cardholder data environment and what connects to it.	The whole IT infrastructure used to run the organisation, or a clearly defined and separately managed sub-set. Cloud services and end-user devices can never be left out.
Assessment	By a QSA, or by self-assessment questionnaire.	A self-assessment marked by an assessor at a certification body. Nobody tests your systems unless you go on to Cyber Essentials Plus.
Renewal	How often you revalidate is set by the card schemes and your acquirer.	Every 12 months, as a complete new assessment against the question set then in force. IASME reviews the scheme each year.

PCI DSS readiness

Guides

Questions firms ask before they apply.

Each guide answers one question, with its sources and the date they were last read.

Cyber Essentials and PCI DSS: do you need both?Checked 13 Oct 2026
They are separate. Customers and government buyers ask for Cyber Essentials; PCI DSS applies if you handle payment card data. Some firms need both.

Sources

NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026. Read 11 Oct 2026
NCSC, Cyber Essentials help and resources. Read 11 Oct 2026
IASME, Important update: changes to Cyber Essentials for April 2026. Read 11 Oct 2026
IASME, Danzell and Willow comparison (question set v16.2). Read 11 Oct 2026
IASME, Cyber Essentials frequently asked questions. Read 11 Oct 2026

IASME's question wording is paraphrased and cited by question number.

Asked for Cyber Essentials?

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.