Cyber Essentials Policy Requirements: What to Write Down
If you're preparing for Cyber Essentials, you've probably seen lists of "documents required to pass". This guide sets out what the scheme actually asks for, which processes are worth writing down, and how written policies help, in plain English for small UK businesses, typically 1–50 staff.
What Cyber Essentials Is
Cyber Essentials is a UK Government-backed certification scheme developed by the National Cyber Security Centre (NCSC) and delivered by its partner, IASME. The NCSC's Cyber Essentials overview describes two levels:
- Cyber Essentials: a verified self-assessment. You answer a set of questions, a board member or equivalent signs them off, and an assessor marks them.
- Cyber Essentials Plus: the same five controls, plus independent technical testing of your systems to check the controls work in practice.
The requirements themselves are set out in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (dated April 2026). Requirements are updated from time to time, so check you're working from the current version before you apply.
Does Cyber Essentials Require Written Policies?
Not as a fixed set. The requirements document doesn't say "you must have an acceptable use policy" or similar. It organises everything under five technical controls and says it's your responsibility to make sure your organisation meets all the requirements. It also notes that you "might also be required to supply evidence" before your certification body awards certification.
In practice, this is where written processes earn their keep. Several requirements are about things you do repeatedly, not settings you change once. Under user access control, for example, the requirements say you must have in place a process to create and approve user accounts, and remove or disable accounts when they're no longer needed. If that process only exists in one person's head, it's hard to describe accurately in the assessment and easy to forget when someone leaves.
Written policies also help beyond the certificate. Customers and insurers often ask to see them, and the same documents support your answers on security questionnaires and cyber insurance proposal forms.
Be wary of anyone who says a set of documents will get you certified. Certification is awarded by an IASME-licensed certification body after you complete their assessment. Policies support that. They don't replace it.
The Five Controls and the Policies That Support Them
This table shows the five technical controls from the v3.3 requirements, what each means in plain English, and the kind of written policy that supports it.
| Control | In plain English | Supporting policy |
|---|---|---|
| Firewalls | Protect every device and cloud service from unwanted internet connections, and change default router and firewall passwords. | Patching, malware and secure configuration; remote working |
| Secure configuration | Remove unused accounts and software, change default passwords, turn off auto-run, and lock devices. | Patching, malware and secure configuration; device and BYOD |
| Security update management | Use only licensed, supported software, turn on automatic updates, and install critical and high-risk fixes within 14 days. | Patching, malware and secure configuration; software and cloud services |
| User access control | Approve accounts, give people only the access they need, use separate admin accounts, use MFA, and remove access promptly. | Access control and passwords; joiners, movers and leavers |
| Malware protection | Use anti-malware or application allow-listing to stop malicious software running. | Patching, malware and secure configuration; acceptable use |
Two other policies aren't directly assessed but are worth having alongside: backup and recovery, because the controls reduce the chance of an attack but don't help you recover from one, and incident response, so staff know what to do if something gets through.
Scope Points That Catch Small Businesses Out
Scope means what's included in the assessment, and it's an easy place to go wrong. The v3.3 requirements are clear on several points:
- Personal devices count. Staff-owned laptops and phones that access organisational data or services are in scope. Devices used only for calls, texts or MFA apps are out of scope.
- Home working counts. By default, home and remote workers' devices are in scope.
- Cloud services can't be left out. If your data or services are hosted in the cloud, such as Microsoft 365 or Google Workspace, those services must be in scope.
- MFA on cloud services is required. The requirements say authentication to cloud services must always use MFA.
- Unsupported software is a problem. Software that no longer gets security updates must be removed or isolated from the internet.
- The 14-day rule. Updates fixing critical or high-risk vulnerabilities must be installed within 14 days of release.
A device and BYOD policy, plus a short list of the devices and cloud services you use, makes these questions much easier to answer.
Processes Worth Writing Down Before You Apply
Whatever format you use, make sure you can clearly describe:
- Your scope: which parts of the business, locations, devices and cloud services the certificate covers.
- Your devices and software: a simple register of laptops, phones, servers, network equipment and cloud services.
- Account approval and removal: who approves new accounts, and how access is removed when someone leaves or changes role.
- Admin accounts: who has them, and that they're used only for admin tasks, not for email or browsing.
- Passwords and MFA: which password approach you use, how you protect against guessing, and where MFA is turned on.
- Updates: how updates are applied, who checks they've installed, and how you meet the 14-day rule.
- Malware protection: which approach you use on each type of device.
- Firewall changes: who can change firewall rules, and how changes are approved and recorded.
What It Costs and Who Certifies
You register through IASME, either on your own (self-led) or with help from an IASME-licensed certification body. At the time of writing, IASME's FAQs list the basic assessment at £320 + VAT for micro organisations (0–9 employees) and £440 + VAT for small organisations (10–49 employees). Cyber Essentials Plus is priced separately. Check IASME for current prices before you budget.
If you'd like expert help putting the controls in place, the NCSC overview page also explains how to find an NCSC-assured Cyber Advisor.
A Readiness Check Before You Apply
Before you pay for an assessment, go through each of the five controls and ask: "Can we honestly say yes to this, for every device and cloud service in scope?" The NCSC's Cyber Essentials resources include the official documents. For a plain-English first pass, our free readiness checklist takes about 15 minutes, covers the five controls plus backups, and shows which policy covers each gap.
Common Questions
Do We Upload Our Policies During the Assessment?
Not normally at the basic level. You answer the assessment questions in writing. But your certification body may ask for evidence before awarding certification, and having written processes makes your answers more reliable.
Will a Policy Pack Get Us Certified?
No document can do that on its own. You need to put the technical controls in place on every device and cloud service in scope, then pass the assessment. Policies help you show those controls are owned and repeatable.
How Often Do We Need to Renew?
Cyber Essentials certification needs to be renewed every year. It's a good moment to review your policies too, and to check whether the requirements have been updated.
Sources
Official guidance referred to in this guide (checked 18 October 2026):
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (PDF, April 2026)
- IASME: Cyber Essentials FAQs
- NCSC: Cyber Essentials resources