What this guide covers
What are the five Cyber Essentials controls?
Cyber Essentials is the UK government-backed baseline scheme. Its own term is “five technical controls.” “Control points” is the phrase readers search with, and it means the same five things.
All five apply at both Cyber Essentials and Cyber Essentials Plus, and both levels are independently verified. That makes this the Cyber Essentials security baseline. NCSC’s Cyber Essentials overview names each control with a one-line purpose:
How do the Cyber Essentials technical requirements work in an assessment?
What counts as scope
The organisation sets scope. The v3.3 document defines it as “the networks, hardware and software assets, and cloud services that are included in the assessment.” The default is “the whole of the IT infrastructure used to carry out your organisation’s business, or if necessary, a well-defined and separately managed sub-set.”
Cloud services are covered directly: “Cloud services cannot be excluded from scope.” Where parts of the infrastructure are left out, “you will need to justify the reason for a partial scope to your assessor.”
How IASME Cyber Essentials assessment and Plus differ
The applicant answers the question set in an IASME assessment account, and an assessor marks it. Plus covers the same five controls and adds a technical audit and testing. This guide does not cover Plus detail beyond NCSC’s description.
The version in force is v3.3, April 2026. The NCSC resources page says it is “effective from 27 April 2026”. IASME names the new question set Danzell and says the changes apply to all assessment accounts created after 26 April 2026.
| Assessment account created | Version | What applies |
|---|---|---|
| On or before 26 April 2026 | v3.2 | Six months to certify on the previous version. |
| After 26 April 2026 | v3.3 · Danzell | Effective from 27 April 2026. |
Confirm the version and the question set against the NCSC resources page before you open an assessment.
Which of the five controls reach a WordPress marketing site?
Security update management is the control that clearly reaches a public site. The scope line in v3.3 reads:
“Publicly available commercial web applications (rather than apps developed in-house) are in scope by default. Bespoke and custom components of web applications are out of scope.”
Cyber Essentials v3.3, scope
The scheme does not name WordPress. Read the line and its exclusion, then note that whether a given install falls inside is our reading and the assessor’s call. For the update control, see the Cyber Essentials security update management guide.
Security update management
Clearly reaches the site
Publicly available commercial web applications are in scope by default under v3.3. Bespoke and custom components are out.
Malware protection
Device control as written
Its stated aim is “To restrict execution of known malware and untrusted software, from causing damage or accessing data”, and it asks for anti-malware software or application allow listing on devices. The scheme text does not describe website malware scanning.
Firewalls, secure configuration, user access control
Named for completeness
NoDrama’s pricing page lists a firewall at the edge, before the website. That protects the site, while the Cyber Essentials firewall control is about the organisation’s own network, so NoDrama claims no coverage of these three controls.
Any mapping of malware protection to a website is NoDrama’s reading, set out in the Cyber Essentials malware protection guide.
Put the scope question to your assessor in writing and keep the answer with the certification file.
What does the 14 day update rule ask for?
The rule sits in the Security Update Management section of v3.3. It reads:
“You must make sure that all software in scope is kept up to date. All software on in-scope devices must:
- be licensed and supported;
- be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet;
- have automatic updates enabled where possible;
- be updated, including vulnerability fixes, within 14 days* of release, where:
- the update fixes vulnerabilities described by the vendor as ‘critical’ or ‘high risk’;
- the update addresses vulnerabilities with a CVSS v3 base score of 7 or above;
- there are no details of the level of vulnerabilities that the update fixes provided by the vendor.
*It’s important that updates are applied as soon as possible. 14 days is considered a reasonable period to be able to implement this requirement.”
Cyber Essentials v3.3, Security Update Management
-
01Release dateVendor publishes the update
-
02Applied dateUpdate is live on the site, within 14 days
-
03RecordBoth dates logged, with the gap
Two figures set the clock:
An update also counts if the vendor calls the fix “critical” or “high risk”, or gives no detail of its level. “Licensed and supported” means software “that you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes”.
Each year the question is when the site was last patched. Without a record, the answer comes from asking whoever built it. A dated log answers it from the page: release date, applied date, and the gap between them. NoDrama’s pricing page and terms do not say whether its reporting carries that level of detail, so confirm it in writing.
Pull the update log and check each critical or high update against its release date.
What can you do about the web layer of the five controls?
Five actions, each ending in an artefact that proves it was done.
Put the scope question to the assessor in writing.
Artefact: the written answer, filed with the certification record.
Keep a dated record of every update to the public site. Put the release date next to the applied date.
Artefact: the log itself.
Check what the site runs before the assessment. List plugins and themes and note which are supported. The plugins and themes screens in WordPress admin are a starting point.
Artefact: the dated list.
Plan the renewal year in advance. PPN 014 says certification “must be renewed annually”.
Artefact: a renewal calendar.
State where the work stops. Devices, the network firewall, user access control and MFA are outside what NoDrama covers.
Artefact: a short scope note saying who owns each.
What each of NoDrama’s three plans includes is listed on NoDrama’s pricing page.
Two of the five controls reach the public site, and someone has to own them.
NoDrama’s care plans keep WordPress, plugins and themes current and scan for malware every 12 hours, which supports compliance work for security update management and malware protection on a public WordPress site.
What do people get wrong about the five controls?
“Malware protection means antivirus on laptops.”
That matches the scheme text. It leaves the position of the public site open, which is a reason to ask the assessor.
“Your site is always in scope.”
The scheme does not name WordPress, and bespoke components are out. Quote the line, then hand the call to the assessor.
“Cyber Essentials applies to every government contract.”
PPN 014 says it “should not be applied to all contracts as a matter of course”.
“Any guide will do.”
A guide that treats v3.2 or the earlier question set as current is out of date for accounts created after 26 April 2026. IASME’s April 2026 pages also say MFA is mandatory for all cloud services where it is available, and that organisations that fail to implement it will now automatically fail the assessment. That consequence is IASME’s wording.
What this does not solve
This guide does not make a supplier certified and does not guarantee a pass. NoDrama supports compliance work for two of the five controls as they apply to a public WordPress site. The assessment, the device controls and the certification stay with the supplier and the assessor.
Conclusion: the five controls and the one that reaches your site
Cyber Essentials has five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. One of them clearly reaches a public WordPress site, and that is security update management, with its 14 day clock for critical and high risk updates. Whether a given install is inside scope is our reading and the assessor’s call, so the written answer belongs in the file. A dated record of each update is the evidence that answers the yearly question about the last patch.