Check if you’d auto-fail

Priority 2 tool · Tailored policies & registers

Get your Cyber Essentials evidence pack

Cyber Essentials is primarily a technical standard — most assessment questions ask how your devices and accounts are actually configured rather than asking you to upload long policy documents. However, written policies and registers help your team answer consistently, back up the director’s new Danzell declaration to maintain controls all year, and satisfy customers and insurers who ask for paperwork.

Important: Every document generated here is marked “Template: review before use. Not legal advice.”

1. Your organisation profile
2. Where to send your tailored pack

What is inside the nine-part evidence pack?

  1. Information security policy (one page): Sets out management commitment and ownership of the five Cyber Essentials controls across the year.
  2. Access control and joiners & leavers procedure: Defines how user accounts are approved, created, reviewed and disabled on the day someone leaves.
  3. Passwords, MFA and passkeys policy: Reflects the v3.3 rules (mandatory cloud MFA, FIDO2 passkeys, 8+ character passwords with MFA or deny list, 12+ characters without, no forced periodic expiry, and 6+ character device PINs with 10-attempt lockout).
  4. Security updates policy: Built around the 14-day mandatory patching rule for operating systems, router/firewall firmware, and applications/extensions.
  5. Personal devices (BYOD) policy: Included if your staff access work email or files on personal phones or computers.
  6. Acceptable use policy: Plain-English rules for staff on email, software installation and home working.
  7. Device and software register (spreadsheet): Tracks laptops, desktops, servers, phones and routers with OS version and end-of-support check.
  8. Admin account register (spreadsheet): Lists every global and local administrator account and confirms separation from day-to-day email.
  9. Cloud services register with MFA status (spreadsheet): Inventories every SaaS, PaaS and IaaS service in scope and how MFA is enforced.