How to fill out a Cyber Essentials questionnaire?

Completing the Cyber Essentials questionnaire might seem like a daunting exercise, but the key word to focus on is ‘Essentials’. When you are answering the questions, try to think about your infrastructure as a whole, not just thinking in too much detail about specific devices that you may have in mind. Looking at secure configuration, URM often finds questionnaire respondents just focussing on password protection rather than protection of the whole infrastructure, e.g., servers, end-user devices, mobile phones, Cloud environments and so on.

Most of the questions are phrased in such a way that only a high level response is required, so don’t write ‘War and Peace’ if it’s not needed . It might be a question about admin accounts, your on-boarding process or firewalls and, generally, you should be thinking about just writing one or two paragraphs to provide the assessor with an understanding of what your infrastructure looks like. Some organisations find it useful to have a checklist when they are answering the different questions. For example, if there is a question on password protection, your checklist will be reminding you to bear in mind all the different types of environments and whether the scope is correct.

There can, of course, be exceptions if the organisation that is applying for Cyber Essentials is large with a complex infrastructure and the processes are not as straightforward. In most cases, however, in the Cyber Essentials world less is more. If you have any query, URM has a dedicated Cyber Essentials Team to help you. Just email cyberessentials@urmconsulting.com