Cyber Essentials 2026 – Lessons Learned From Actual Assessments
In this episode of InfoSec Insider – Talk Cyber, Jamie Leavers, Security Consultant at URM, and Lauren Gotting, New Business Director at URM, share real-world lessons learned from conducting hundreds of CE and CE+ assessments, including early assessments against the new Danzell requirements. Jamie and Lauren leverage their extensive experience with the Cyber Essentials scheme to discuss:
- Lessons from real CE/CE+ assessments, what assessors are seeing in practice, and what separates successful submissions from failed ones
- The Danzell Question Set and key changes introduced in 2026 and how they impact both new applicants and recertifying organisations
- How to prepare for certification or recertification, including ractical guidance to ensure your evidence, scope and controls meet assessor expectations.
- The common issues and pitfalls most frequently causing delays or failures and how to avoid them entirely.
About the InfoSec Insider
The InfoSec Insider podcast brings you weekly interviews with practicing senior consultants, who draw upon their extensive experience to provide detailed and practical guidance on all things information and cyber security, data protection compliance, risk management, and more. In each episode, one of our experts takes a deep-dive into a particular aspect of their area of specialism, whether that be certifying to ISO 27001, outlining some top tips for GDPR compliance, making the case for alternative approaches to pen testing, or discussing how to conduct an effective business impact analysis (BIA). Enhance your understanding and professional skillset with the InfoSec Insider podcast, brought to you by URM, the UK’s leading provider of cyber security and governance, risk management and compliance consultancy.
Contact the InfoSec Experts Today
Having assisted over 450 organisations to implement an ISMS and then achieve ISO 27001 certification since the Standard was first published in 2005, we at URM are the ideal partners to help you certify. With our fully-tailored approach, our specialists can support you through each stage of the ISO 27001 management system lifecycle, offering guidance specific to your organisation’s unique requirements.
Get in touch with our information security experts today to find out more.
InfoSec Solutions & Products
One the key requirements of ISO 27001 is the need for a robust risk assessment process which can produce repeatable and comparable results. With its proven, best practice methodology, URM’s information security risk management software, Abriska 27001, enables you to meet this requirement. We can also assist you to raise and maintain awareness among your staff with our expertly designed and engaging learning management system (LMS), Alurna.
InfoSec Training Courses
Our information security and risk management training courses can help you learn how to effectively manage information security. Our Certificate in Information Security Management Principles (CISMP) and Practitioner Certificate in Information Risk Management (PCIRM) training courses will prepare you to take the BCS (Chartered Institute for IT) administered exams, enabling you to gain industry-recognised qualifications.
Webinars & Events
URM has gained a reputation as the preeminent UK provider of live webinars, aimed at delivering valuable and practical insights to organisations looking to improve their information security, risk management, data protection etc. The webinars are delivered by our senior consultants who share hints and tips on topics such as certifying to ISO 27001 and Cyber Essentials, complying with the GDPR. All of our webinars are completely free to attend, and include an opportunity to ask questions at the end.
URM will look at what effective GDPR compliance looks like for small and medium-sized enterprises (SMEs) in 2026.
We'll look at where AI is genuinely useful, where its limitations remain, and how it is affecting penetration testing and cyber defence in practice.
This session will show you exactly what assessors look for, where organisations fall short, and how to position your submission for a successful outcome.
Information Security FAQs
What are 4 types of information security?
If we look to guidance from Annex A of ISO 27001, then the answer is organisational, people, physical and technological. The International Standard groups information security into these 4 categories. The ‘organisational’ category requires the creation of policies, roles and responsibilities and day-to-day business activities. The ‘people’ category ensures that the most appropriate staff are employed, and that they understand what is expected of them in relation to the business’ approach to infosec. ‘Physical’ controls relate to the security of business premises, clear desk policies etc, whilst, ‘technological’ controls relate to measures that may be adopted by organisations to assist in securing information through the use of technology such as capacity management, configuration management, change management, network security, firewalls, cryptography etc.
What are the 3 principles of information security?
The three aspects that information security (infosec) seeks to protect are ‘confidentiality’, ‘integrity’ and ‘availability’. Confidentiality ensures that information is not made available or disclosed to unauthorised entities. Integrity protects the accuracy and completeness of assets, whilst Availability ensures that information is accessible and usable on demand by authorised individuals.tc.
What are information security examples?
Examples of information security include encryption, firewalls, antivirus software, multi-factor authentication (MFA), vetting of individuals, controlling access to premises / information and providing staff awareness training.
What are 5 information security policies?
Policies provide direction on your organisation’s approach to different aspects of information security management. Policies may relate to the classification of data, password management, acceptable use of assets, authentication procedures and incident response - these are five examples, but your organisation may choose to formulate a policy relating to any aspect of information security (infosec) management.
