Cyber Essentials 7: submit the self-assessment without guesswork

Use the actual assessment portal and version

The basic certificate is a verified self-assessment, not an independent technical audit of every device. An assessor reviews your answers. That makes precision important: a confident description of a planned control is still an inaccurate answer about today's environment.

Before entering answers, confirm the legal entity, scope, applicable question set and certification body. This series is written around Danzell and requirements v3.3. Keep the current questions beside your evidence index. Follow the actual portal wording and guidance; this tutorial is not a replacement questionnaire or an answer key.

Ask the certification body about the assessment validity period, submission process, clarification handling and any additional charges. Record the date and contact. Do not infer your contractual deadline from a blog about another provider's service.

Draft answers with an evidence owner

Divide the questions by the person who can substantiate the answer. IT may explain endpoint controls; finance or an application owner may need to confirm a cloud service or legal entity. Bring the answers back into one consistent scope rather than allowing each contributor to describe a different estate.

Write about implementation. “We use an MSP” says who helps you, not what protects your devices. “We have a policy requiring updates” explains intention, not whether required fixes were installed. Use the relevant versions, configuration and coverage information requested by the form, with additional explanation where it resolves an ambiguity.

An illustrative internal note might read: “Update evidence is in UPD-04, reconciled to DEV-01 on the review date; three failures identified last week were remediated and rechecked.” That is an evidence pointer, not wording to paste regardless of your facts. Keep your evidence notes separate where the portal expects a short specific answer.

Resolve contradictions before signing

Check counts and descriptions across the submission. A statement that nobody uses BYOD should agree with the scope discovery and sign-in evidence. An answer about a single office firewall should not leave remote staff unexplained. An assertion that all cloud authentication uses MFA should reconcile with the cloud service list.

At fictional Merefield, the coordinator finds the CRM listed in the cloud register but missing from the authentication answer. The team checks its settings, corrects the answer and updates the evidence index. They do not remove the CRM from the register to make the paperwork agree. The underlying environment determines the answer.

If a question does not fit an unusual architecture, seek written clarification from the assessor with enough detail to be useful. Include the relevant requirement, device/service type and proposed interpretation. Avoid sending credentials or entire customer datasets. Keep the answer to that clarification with the submission so it is available for Plus preparation.

Give the signatory a short decision pack

The authorised signatory must understand what they are confirming and the scheme's declaration requirements. Prepare a concise covering note with the scope, version, technical review owner, unresolved matters and the location of supporting evidence. Follow the portal's sign-off rules rather than assuming any employee can approve.

A director's willingness to accept a risk does not change a scheme requirement. If the sign-off meeting reveals an unmet mandatory condition, stop the declaration and fix it. Do not write an answer that implies the condition is met because a replacement has been ordered.

Deal with assessor questions as normal work

Assign one coordinator to receive clarification requests and obtain accurate responses from the responsible owner. Preserve the question, response and resulting change. If a technical answer changes, check whether other answers or the scope are affected. A small clarification can reveal an estate-wide gap.

When the environment changes during assessment, tell the assessor where relevant. For example, a new cloud service or replacement batch can affect the facts being assessed. Do not keep a frozen answer that no longer describes the organisation simply because it has already been typed into the portal.

After certification, verify the entity, scope and dates on the certificate and retain the final submission. Confirm the record through the scheme's certificate search where appropriate. Use the certificate only in ways its scope supports; it should not be described as a guarantee that every system or product is secure.

Prepare the Plus handover now

If Plus is the objective, send the assessor the agreed scope and current population through the secure route, confirm testing availability and establish the final completion date in writing. Do not wait until the end of the basic certificate's window to start arranging users and devices.

Your deliverable is the submitted assessment, its evidence index, sign-off record, assessor correspondence and the Plus plan. Part 8 covers technical testing, retests and the work needed to keep the result credible after the assessor leaves.

Check your understanding