How to prepare for Cyber Essentials? Preparing for Cyber Essentials starts from two things: defining the certification scope correctly and downloading the current requirements version. A wrong scope and working from an outdated question set are the two most common causes of assessment failure – before an organisation even gets to the controls. This list orders preparation into five actions and five mistakes.
Canonical definition: Cyber Essentials is a UK cybersecurity certification scheme built on five technical controls, in two levels – Cyber Essentials (a verified self-assessment) and Cyber Essentials Plus (an independent technical audit) – renewed annually.
This article is a practical guide to preparing for CE and CE Plus: what to do first and which mistakes to avoid so the assessment succeeds first time.
Cyber Essentials – key takeaways:
- The starting point is defining the certification scope correctly – what falls within the assessment boundary, including devices, users and cloud services.
- Always work from the current requirements version – currently 3.3 (“Danzell”), effective from 27 Apr 2026; working from an old set is a common cause of failure.
- Cloud services (IaaS, PaaS, SaaS) cannot be excluded from scope – the current version expressly requires this.
- Prepare for CE Plus as for a genuine test, not for filling in a questionnaire – the Certification Body verifies the controls hands-on.
- The most common mistake is understating the scope to “pass more easily” – it ends in assessment failure or a certificate without cover.
- Patronusec helps define the scope, identify gaps against the current requirements and prepare the organisation for CE and CE Plus.
Table of Contents
Why does a correct scope decide certification success?
A correct scope decides certification success, because it sets the boundaries of what is assessed – and a wrongly defined scope leads either to assessment failure or to a certificate that does not reflect the organisation’s genuine security. Scope is the first decision to make and the most common source of problems.
Scope in Cyber Essentials covers the devices, users and services assessed against the five controls. Crucially, the current requirements version removed many routes to excluding elements from scope – in particular, cloud services (IaaS, PaaS, SaaS) must be in scope and cannot be omitted. The definition of a cloud service was clarified precisely to reduce the ambiguity organisations previously stumbled over.
The temptation is always the same: narrow the scope to “pass more easily”. This is a mistake. An understated scope will either be caught by the Certification Body (assessment failure) or lead to a certificate that does not cover the infrastructure actually used – and so to a false sense of security and the risk of losing the certificate on verification. A correct scope reflects reality, not wishes.
A scope understated to pass the assessment more easily does not give easier certification – it gives a certificate that does not hold up to verification, and a false sense of security where the gap was left untouched.
Top 5 things to do in CE and CE Plus certification
The five tasks below set the right order for preparing for Cyber Essentials and CE Plus. The common denominator: first establish the boundaries and current rules of the game, then close the controls, and finally confirm readiness with a test.
Define the certification scope correctly. Establish which devices, user accounts and services (including cloud) fall within the assessment boundary. Remember cloud services cannot be excluded. A scope reflecting reality is the foundation of the whole preparation.
Download and work from the current requirements version. Always use the latest requirements and question set – currently version 3.3 (“Danzell”), effective from 27 Apr 2026. Working from an outdated set is one of the most common, yet most avoidable, causes of failure.
Run a gap analysis against the five controls. Compare the current state with the requirements for firewalls, secure configuration, security update management, user access control and malware protection. Pay attention to the strengthened multi-factor authentication and backup requirements.
Close the controls before you apply. Implement the missing elements before assessment, not during it. Certification confirms an existing state – trying to “close things live” during a CE Plus assessment, where controls are tested hands-on, ends in failure.
Prepare for CE Plus as for a genuine test. In Cyber Essentials Plus the Certification Body verifies the controls hands-on, not from a declaration. Treat preparation as preparation for a technical audit: make sure the controls actually work on a sample of devices, not just in documentation.
Top 5 things to avoid
The five mistakes below most often lead to Cyber Essentials assessment failure or to a certificate without genuine cover. The common denominator: confusing certification with a formality and trying to “take shortcuts”.
❌ Understating the scope to pass more easily. Narrowing the assessment boundary will be caught or lead to a certificate not covering the real infrastructure. A correct scope reflects reality, not convenience.
❌ Excluding cloud services from scope. The current requirements version expressly forbids this – IaaS, PaaS and SaaS must be in scope. Trying to omit them is a typical cause of assessment failure under the new requirements set.
❌ Working from an outdated requirements version. Using an obsolete question set is one of the most avoidable causes of failure. Always download the latest version before starting preparation.
❌ Treating CE Plus like a self-assessment. In CE Plus the controls are tested hands-on by the Certification Body. A “we will fill in the questionnaire” approach fails when the auditor checks whether a control works on a device. CE Plus requires genuine technical readiness.
❌ Treating certification as a one-off. Cyber Essentials is renewed annually against an updated requirements set. An organisation that “certifies and forgets” loses compliance when the requirements change and its environment drifts from the state on assessment day.
Patronusec Insight: In our project experience, the most common cause of a failed Cyber Essentials assessment is not a lack of safeguards but a wrong scope and working from an old requirements set – mistakes that can be avoided in the first hour of preparation. Organisations focus on the controls and trip over the decisions before the controls: what is in scope and against which version we assess. We recommend redirecting attention at the start: first define the scope correctly and download the current requirements, and only then address the controls. It is the cheapest investment in passing the assessment first time.
How to combine CE and CE Plus preparation into one process?
CE and CE Plus preparation combine into one process, because both levels cover the same five controls – only the method of verification at the end differs. The right sequence is: establish the scope and current requirements, close the controls, confirm readiness, and for CE Plus add preparation for the hands-on test.
The recommended sequence:
- Scope and version. Correct assessment boundaries (with cloud services) and the current requirements set (3.3 “Danzell”).
- Gap analysis. Comparing the state with the five controls, with particular attention to MFA and backups.
- Closing the controls. Implementing the missing elements before assessment, not during it.
- Readiness verification. Confirming the controls work – for CE declaratively and with evidence, for CE Plus hands-on on a sample of devices.
- Maintenance. A plan for annual renewal and monitoring changes in the environment and in the requirements set.
The key difference concerns the last stage before assessment. For Cyber Essentials it is enough to demonstrate the controls are met (a verified self-assessment). For Cyber Essentials Plus you must additionally prepare for the Certification Body to test the controls itself – meaning they must genuinely work, on a sample of devices, not just be described. Preparation for CE naturally leads to CE Plus; many organisations aim straight for CE Plus, treating CE as an intermediate stage.
Patronusec helps navigate this process within preparation for Cyber Essentials and CE Plus – from defining the scope, through gap analysis against the current requirements, to verifying readiness for the CE Plus hands-on test.
FAQ – How to prepare for Cyber Essentials
What is the most common cause of Cyber Essentials assessment failure?
The most common causes are a wrongly defined scope and working from an outdated requirements version – mistakes made before addressing the controls. Narrowing the scope (especially excluding cloud services, which the current version forbids) and using an obsolete question set lead to failure, even though the organisation may have safeguards in place.
Must cloud services be in scope for Cyber Essentials?
Yes. The current requirements version expressly states that cloud services (IaaS, PaaS, SaaS) cannot be excluded from scope. The definition of a cloud service was clarified to remove the ambiguity organisations previously stumbled over. Trying to omit the cloud is a typical cause of assessment failure.
How do I prepare for Cyber Essentials Plus?
Prepare for CE Plus as for a genuine technical audit, not for filling in a questionnaire. The Certification Body verifies the controls hands-on on a sample of devices. Make sure the five controls actually work – firewalls, configuration, updates, access control and malware protection – not just that they are described in documentation.
Which Cyber Essentials requirements version should I use?
Always the latest. The current requirements set is version 3.3 (“Danzell”), effective from 27 Apr 2026. The set is updated annually by IASME in collaboration with the NCSC. Before starting preparation, download the latest version – working from an old set is one of the most avoidable causes of failure.
Can I aim straight for CE Plus, skipping CE?
Cyber Essentials Plus covers the same five controls as the base level, adding a hands-on test. Many organisations aim straight for CE Plus, treating control preparation as a shared foundation. The condition is genuine technical readiness – CE Plus does not tolerate “closing things live”, because the controls are tested hands-on.
How does Patronusec help with CE and CE Plus certification?
We help across the whole preparation: we define the correct scope (with cloud services), download the current requirements, run a gap analysis against the five controls and support implementing the missing elements. For CE Plus we prepare the organisation for the hands-on test, verifying the controls genuinely work. The certificate is issued by an accredited Certification Body – we bring you to readiness.
Recommended reading
A reading path for Cyber Essentials:
- What is Cyber Essentials – benefits and advantages – the foundation: what the scheme is and what benefits it brings.
- Who is Cyber Essentials for, who is CE Plus for and what links them to ISO 27001 and PCI DSS – choosing the level and mapping to other standards.
- A business continuity plan in 5 steps – an element of the organisation’s wider resilience.
Cyber Essentials – free consultation
Patronusec helps organisations prepare for Cyber Essentials and Cyber Essentials Plus – from defining the scope correctly and gap analysis against the current requirements, to verifying readiness for the CE Plus hands-on test. Book a free consultation.
