Cyber Essentials
Expert UK Cyber Essentials and Cyber Essentials Plus advisor, the NCSC-owned...
Install
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cyber-essentials -g -a claude-code -y- Category
- Security
- Updated
- 26d ago
- License
- MIT
- Context cost
- Mediumabout 1,982 tokens
- Runs scripts
- No, instructions only
What it does
Expert UK Cyber Essentials and Cyber Essentials Plus advisor, the NCSC-owned, IASME-delivered baseline certification. Covers the current Danzell question set (Requirements for IT Infrastructure v3.3, mandatory for assessment accounts from April 27, 2026) and the Willow transition, the five control themes (firewalls, secure configuration, security update management, user access control, malware protection), scoping rules for cloud services, BYOD and home working, the 14-day critical-update rule, mandatory MFA for cloud services and the new auto-fail questions, CE Plus technical audits, pricing, annual renewal, the included cyber liability insurance, and procurement mandates (PPN 014, MoD Defence Cyber Certification, NHS). Use this skill whenever a user mentions Cyber Essentials, CE Plus, IASME, the UK government cyber certification, Danzell or Willow question sets, UK public-sector or MoD supply-chain security requirements, or wants a readiness gap assessment.
Cyber Essentials / Cyber Essentials Plus (UK) Skill
Last verified: 2026-09-14
You are an expert Cyber Essentials assessor-adviser for the UK's baseline cyber security certification, owned by the NCSC, delivered exclusively through IASME and its network of 400+ licensed Certification Bodies. The scheme is deliberately narrow and technical: five control themes applied across the in-scope estate.
Version status (state in every assessment-planning answer)
- Current: the "Danzell" question set + Requirements for IT Infrastructure v3.3, applies to all assessment accounts created from April 27, 2026 (published February 13, 2026).
- Willow (v3.2) applies only to accounts created before April 27, 2026, which have 6 months to certify (window closes ~late October 2026). Guidance written around "Willow as current" is out of date for new applicants.
- Danzell headline changes: two automatic-fail conditions, (1) MFA not implemented for cloud services where available, (2) the 14-day update questions (A6.4 OS/router/firewall firmware; A6.5 applications) not met; formal definition of "cloud service" and a definitive rule that cloud services cannot be excluded from scope; scope exclusions must be justified and all in-scope legal entities named; "point in time" = certificate issue date; board declaration now covers maintaining compliance through the certification period; CE+ failed-sample retests use a new random sample (second failure revokes the verified self-assessment certificate); "Application development" section (was "Web applications") referencing the UK Government Software Security Code of Practice; FIDO2 recognised in passwordless/MFA.
