SecurityEurope & UK

Cyber Essentials v3.2

Keep your v3.2 readiness work easy to review

Maintain scoped tasks and evidence for a Cyber Essentials v3.2 assessment where that edition applies.

Selected focus areasSecurity

Cyber Essentials v3.2UK NCSC

Assessment scope

Device coverage

Technical checks

Evidence follow-up

Owned work

Supporting evidence

Review

Version note. Cyber Essentials v3.2 is an earlier requirements edition. NCSC identifies v3.3 as effective from 27 April 2026. Confirm the edition that applies to your assessment. See the Cyber Essentials overview

Full title: Cyber Essentials: Requirements for IT Infrastructure v3.2, used with the Willow question set
Issued by: UK National Cyber Security Centre (NCSC), delivered through IASME and its licensed Certification Bodies
In effect: From 28 April 2025 for new applications, until v3.3 took effect on 27 April 2026
Status now: Superseded by v3.3 (Danzell). Accounts created before 27 April 2026 have six months to certify under v3.2.
Nature: Technical requirements for a voluntary UK certification scheme, at self-assessment and Plus levels
Structure: Scope rules, five technical control themes, and a companion Plus Test Specification v3.2

Overview

What Cyber Essentials v3.2 is

Cyber Essentials v3.2 is the edition of the scheme’s technical requirements that applied to applications started on or after 28 April 2025. It is set out in the NCSC document Cyber Essentials: Requirements for IT Infrastructure v3.2 and applied through the Willow question set that applicants answered. The Cyber Essentials Plus Test Specification v3.2 described how assessors tested the same controls at Plus level.

The edition kept the five control themes unchanged: firewalls, secure configuration, security update management, user access control and malware protection. Its changes from v3.1 were mostly clarifications. It added guidance on passwordless authentication, updated definitions for software, vulnerability fixes and passwordless authentication, extended security update management to vulnerabilities that are fixed only by a configuration change, and renamed home working as home and remote working to cover places such as cafés, hotels and trains.

v3.2 has now been replaced. The NCSC identifies v3.3, with the Danzell question set, as the current version, effective from 27 April 2026. Applications started before that date can continue to follow v3.2, and IASME gives accounts created before that date six months to certify under it. New applications follow v3.3, described on the Cyber Essentials page.

v3.2 remains relevant for organisations still completing an assessment under it, and for understanding certificates issued under it, which run for 12 months from issue. When those organisations renew, they are assessed against the requirements then in force.

Who it applies to

v3.2 applies to:

Applications started on or after 28 April 2025 and before 27 April 2026
Accounts created before 27 April 2026 that are still within their six-month window to certify under v3.2
Cyber Essentials Plus audits that follow a self-assessment completed under v3.2
Organisations reviewing a supplier’s certificate issued under v3.2 during its 12-month validity

For any new application, confirm with your Certification Body which version applies. Since 27 April 2026, new applications follow v3.3.

Structure

How the v3.2 requirements are organised

The document sets out scope rules, then the requirements for each of the five control themes. The Plus Test Specification sets out how the same controls are tested.

Scope

Scope and definitions

Whole organisation or sub-set: Scope covers the whole IT infrastructure or a separately managed sub-set. Devices are in scope if they accept incoming connections from untrusted internet-connected hosts, make user-initiated outbound connections to the internet, or control data flow between them.
Cloud services: Cloud-hosted data and services must be in scope. The organisation stays responsible for the controls, even where an IaaS, PaaS or SaaS provider implements some of them under contract.
Home and remote working: Renamed in v3.2. Corporate and BYOD devices used for home and remote working are in scope. Routers not supplied by the organisation are out of scope, so devices need software firewalls.
Web applications: Publicly available commercial web applications are in scope by default. Bespoke and custom components are out of scope.

Control 1

Firewalls

Every in-scope device is protected by a correctly configured firewall. Default administrative passwords are changed, administrative interfaces are not reachable from the internet without a documented need and protection, unauthenticated inbound connections are blocked by default, and inbound rules are approved, documented and removed when no longer needed.

Control 2

Secure configuration

Unnecessary accounts, software and services are removed or disabled, default passwords are changed and auto-run is disabled. Devices are unlocked with a biometric, password or PIN, protected against brute force, with at least six characters where the credential only unlocks the device.

Control 3

Security update management

Software is licensed and supported, and unsupported software is removed. Vulnerability fixes rated critical or high risk, with a CVSS v3 base score of 7 or above, or with no severity given, are applied within 14 days. New in v3.2: the term vulnerability fixes covers patches, updates, registry fixes, configuration changes and scripts.

Control 4

User access control

Accounts are approved, unique and removed when no longer needed, and administrative accounts are kept separate. MFA is implemented where available and must always be used for cloud services. Passwords meet the minimum length and brute-force rules. New in v3.2: guidance on passwordless authentication such as biometrics, security keys, one-time codes and push notifications.

Control 5

Malware protection

Every in-scope device runs anti-malware software that is kept updated and blocks malicious code and websites, or uses application allow listing so that only approved, signed applications run.

Plus

Cyber Essentials Plus Test Specification v3.2

Five test cases: Remote vulnerability assessment, an authenticated patching check, a malware protection check, an MFA check on cloud services and an account separation check.
Scope match: New in v3.2: the Plus scope must match the self-assessment scope, verified by the assessor, including correct segregation of any sub-set.
Sampling and records: New in v3.2: the assessor verifies that the sample size follows the method set by IASME, and the Certification Body keeps verification evidence for the life of the certificate.
Name: The word “illustrative” was dropped from the document’s title.

Implementation roadmap

How to implement it, step by step

For an organisation still completing a v3.2 assessment, or preparing to move to v3.3 at renewal.

1
Confirm which version applies
Check the date your assessment account was created with your Certification Body. If it was before 27 April 2026, confirm how much of the six-month window remains.
OutputsAccount creation dateConfirmed version
2
Confirm the scope
Agree whole-organisation or sub-set scope and list devices, cloud services, BYOD and home and remote working devices.
OutputsScope statementInventory
3
Check the five controls
Compare the estate with each v3.2 requirement and record gaps with owners, especially MFA on cloud services, unsupported software and the 14-day update rule.
OutputsGap list
4
Remediate
Close the gaps and keep configuration and update records as evidence.
OutputsRemediation evidence
5
Submit the Willow question set
Complete the question set and have a board member or equivalent sign the declaration before the window closes.
OutputsSubmitted answersSigned declaration
6
Complete Plus testing, if required
Arrange the technical audit within three months of the self-assessment certificate, against the Plus Test Specification that applies.
OutputsPlus test results
7
Plan the move to v3.3
Before renewal, review the v3.3 changes: cloud services cannot be excluded, missing MFA and late updates lead to automatic failure, and the declaration covers the whole certification period.
Outputsv3.3 gap listRenewal plan

Audit and evidence guide

What auditors look for, and the evidence to keep

v3.2 assessments are marked by an assessor at a Certification Body licensed by IASME, against the Willow question set. Plus audits test the same controls through the five test cases.

What reviewers look for

A scope that matches the real estate, including cloud services, BYOD and remote working devices
MFA on every cloud service
Vulnerability fixes rated critical or high applied within 14 days
No unsupported software in scope
Separate administrative accounts
Changed default passwords and removed unnecessary accounts
Approved and documented firewall rules
Malware protection on every in-scope device

Key timelines

v3.2 and Willow in effect	From 28 April 2025
v3.3 and Danzell take effect	27 April 2026
Accounts created before 27 April 2026	6 months under v3.2
Certificate validity	12 months
Critical and high fixes applied	Within 14 days
Plus audit after self-assessment	Within 3 months

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Scope

Scope statement
Network boundary
Sub-set segregation evidence

Inventory

Devices and operating systems
Cloud services
BYOD register

Configuration

Firewall rule approvals
Hardening settings
Device lock settings

Updates

Automatic update settings
Patch and fix records
Unsupported software removal

Access

MFA settings per cloud service
Admin account list
Leaver records

Malware

Anti-malware coverage
Allow list policy where used

Areas that often need attention

Cloud services without MFA
Unsupported operating systems or applications on a few devices
Fixes applied after 14 days, including configuration-only fixes
Home and remote working devices left out of scope
Administrative accounts used for email or browsing
Assuming v3.2 still applies to a new application after 27 April 2026

How Netra helps

Where each part of the work lives in Netra

Netra loads Cyber Essentials as requirements and tasks, so the controls are owned and evidenced throughout the year, and the move from v3.2 to v3.3 becomes a list of specific changes rather than a fresh start.

Each control owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates, and recurring tasks keep update, access and firewall evidence current.

Readiness against each control

Compliance Centre

Status is derived from completed tasks and evidence, so remaining gaps are visible before submission.

Devices and cloud services in scope

Asset Management

Assets are linked to the tasks that cover them.

Supporting policies

Policy Hub

A policy library generated at onboarding, with a policy score.

Readiness review before submission or Plus

Audit Centre

An internal readiness audit with findings and corrective actions, using evidence in a tamper-evident vault.

Readiness for leadership

Dashboard & Reports

A live Posture Score and a one-click report for the board member signing the declaration.

Netra organises the work and evidence. It is not a Certification Body, does not award certificates or run Plus testing, and does not by itself establish that an organisation meets the scheme. Confirm with your Certification Body which version applies, and confirm the version loaded in Netra before relying on it for a v3.3 assessment.

Common questions

Related frameworks

View all frameworks

Security

See Cyber Essentials v3.2 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.