Cyber Essentials questionnaire: what customers ask and how to answer

Cyber Essentials is a UK government-backed scheme that sets out a baseline of technical controls to protect against the most common cyber attacks. When a customer sends you a questionnaire, they will often either ask whether you hold Cyber Essentials, or ask about the same five control areas in their own words.

Either way, you can answer honestly and clearly without being a security expert. This guide explains what each area means and shows example answers.

Cyber Essentials vs a customer questionnaire

It helps to separate two things. Cyber Essentials itself is a certification you earn by completing an official self-assessment (verified by a certification body) and, for Cyber Essentials Plus, a hands-on technical audit. A customer security questionnaire is your customer’s own due-diligence form, which may ask "do you have Cyber Essentials?" and will usually also ask about the underlying controls directly.

So you do not need to have gone through certification to answer a questionnaire. You describe the controls you actually have in place.

The five areas customers check

Cyber Essentials is built around five technical control areas. In plain English:

• Firewalls: every device that connects to the internet sits behind a properly configured firewall.
• Secure configuration: devices and software are set up safely: default passwords changed, unnecessary accounts and apps removed.
• User access control: people sign in with their own accounts, have only the access their role needs, and admin rights are tightly limited. Multi-factor authentication is used wherever possible.
• Security update management: important security updates are applied promptly (within 14 days for high-risk ones), and software that is no longer supported is removed.
• Malware protection: anti-malware or application allow-listing stops untrusted software running.

How to answer "Do you hold Cyber Essentials?"

Answer honestly with your real status. If you are certified, say so and give the year. If you are working towards it, say that with a rough timeframe. If you are not pursuing it, describe the controls you have instead, rather than leaving a bare "no".

Answering the technical questions

For each control area, describe what you actually do in one or two plain sentences. You do not need jargon. If something genuinely does not apply, say so and why. If there is a gap, say what you do today and what you are putting in place.

Do you need Cyber Essentials to win the deal?

Often not. Many customers accept a clear description of equivalent controls, especially from a small supplier. That said, Cyber Essentials is inexpensive and can remove friction, so it is worth considering if you are asked for it repeatedly.

A faster way to answer

Tickbox recognises Cyber Essentials-style questions and drafts an answer for each in your own words, grounded in the current controls, and shows which control each answer draws on. You review and send, and it never claims you are certified. Your first few answers are free.

Example answers

These are illustrative drafts. Tickbox writes answers like these in your own words, grounded in your policies and the relevant framework.

Frequently asked questions

More guides