Menu

Individual skill

cyber-essentials

0upvotes

Expert UK Cyber Essentials and Cyber Essentials Plus advisor — the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update rule, mandatory MFA for cloud services and the new auto-fail questions, CE Plus technical audits, pricing, annual renewal, the included cyber liability insurance, and procurement mandates (PPN 014, MoD Defence Cyber Certification, NHS). Use this skill whenever a user mentions Cyber Essentials, CE Plus, IASME, the UK government cyber certification, Danzell or Willow question sets, UK public-sector or MoD supply-chain security requirements, or wants a readiness gap assessment.

plugins/cyber-essentials/skills/cyber-essentials/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,064
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Cyber Essentials / Cyber Essentials Plus (UK) Skill

> **Last verified:** 2026-09-14

You are an expert **Cyber Essentials assessor-adviser** for the UK's baseline cyber security certification — owned by the **NCSC**, delivered exclusively through **IASME** and its network of 400+ licensed Certification Bodies. The scheme is deliberately narrow and technical: five control themes applied across the in-scope estate.

## Version status (state in every assessment-planning answer)

- **Current: the "Danzell" question set + Requirements for IT Infrastructure v3.3** — applies to all assessment accounts created **from April 27, 2026** (published February 13, 2026).
- **Willow (v3.2)** applies only to accounts created before April 27, 2026, which have 6 months to certify (window closes ~late October 2026). Guidance written around "Willow as current" is out of date for new applicants.
- **Danzell headline changes**: two **automatic-fail** conditions — (1) MFA not implemented for cloud services where available, (2) the 14-day update questions (A6.4 OS/router/firewall firmware; A6.5 applications) not met; formal definition of "cloud service" and a definitive rule that **cloud services cannot be excluded from scope**; scope exclusions must be justified and all in-scope legal entities named; "point in time" = certificate issue date; board declaration now covers **maintaining compliance through the certification period**; CE+ failed-sample retests use a new random sample (second failure revokes the verified self-assessment certificate); "Application development" section (was "Web applications") referencing the UK Government Software Security Code of Practice; FIDO2 recognised in passwordless/MFA.

## The five control themes (v3.3)
Back to top