A Cyber Essentials Evidence Example That Stands Up

A credible cyber essentials evidence example is not a folder full of screenshots collected a week before an assessment. It is a clear, traceable record showing what is in scope, which controls are operating, where exceptions sit and who owns the remediation. That distinction matters when a certification deadline, customer questionnaire or cyber insurance renewal exposes the gaps between policy and reality.

For organisations with hybrid estates, evidence gathering is often harder than applying the control itself. Devices sit across offices, cloud platforms and home networks. User access changes daily. A configuration report may be accurate when exported, yet already out of date by the time it reaches the assessor. The aim is not simply to prove compliance once. It is to create assurance that leadership and auditors can trust.

What a Cyber Essentials evidence example should show

Cyber Essentials focuses on practical controls that reduce exposure to common cyber attacks. An effective evidence pack should therefore make it easy to connect each answer in the assessment to a verifiable source of information. It should show the current environment, not an idealised inventory or a policy that has not been tested against live systems.

Take secure configuration. A weak submission might include a security policy and a handful of screenshots from endpoint management. A stronger example identifies the relevant assets, shows the approved configuration baseline, confirms which devices meet it, and records exceptions with named owners and due dates. An assessor can follow the logic without asking the security team to reconstruct the story from emails and spreadsheets.

The same principle applies across the control areas. Good evidence is specific enough to be tested, current enough to be meaningful and organised enough to be reviewed quickly. It should also reflect the certification scope. If a subsidiary, hosted service or device group is outside scope, document why. Ambiguity around scope creates unnecessary challenge later.

A practical Cyber Essentials evidence example

Consider a mid-market organisation with Microsoft 365, Intune-managed laptops, Azure workloads, on-premises Active Directory and a small number of servers supporting operational services. Its security team is preparing for Cyber Essentials renewal while responding to a customer request for assurance.

For the firewall and internet gateway control, the evidence includes a current list of internet-facing assets, confirmation of the gateways protecting each environment, and approved rules or configuration exports for externally exposed services. It also identifies services that are intentionally published, their business owner and the reason they need to be accessible. This prevents a familiar problem: an open port is found during review, but nobody can explain whether it supports a critical service or is simply legacy exposure.

For secure configuration, the organisation presents device configuration reports showing screen-lock settings, administrative privilege controls and the removal of unnecessary software. The report separates compliant, non-compliant and unknown devices. Unknown is a valuable category. It signals that the team is not assuming every endpoint is managed merely because it appears in a procurement record.

For user access control, the evidence shows the joiner, mover and leaver process alongside a current view of privileged accounts. It highlights accounts with administrative rights, inactive accounts awaiting removal and exceptions approved for operational reasons. A policy alone cannot show whether former staff retain access or whether privileged access has expanded without review. Live identity evidence can.

For malware protection, the organisation shows the approved protection service, deployment coverage and alert status across in-scope endpoints. If a specialised operational device cannot support the standard endpoint tool, the exception is documented with compensating controls, ownership and a review date. Cyber Essentials does not reward hiding constraints. It rewards sensible control of risk within the environment being assessed.

For security update management, the team provides patch compliance by device type and software family, records of critical updates applied within the required timeframe, and outstanding vulnerabilities ranked by exposure and service impact. This is where business context becomes decisive. A missing update on a disconnected test machine is not equivalent to the same gap on a server supporting a public-facing service or finance operation.

A concise evidence pack might contain these five elements:

• a confirmed list of in-scope users, devices, software, cloud services and networks;
• dated configuration and coverage reports mapped to each relevant control;
• evidence of patching and remediation activity, including overdue exceptions;
• access and privilege reports that identify accountable owners; and
• a short exception register explaining risk acceptance, compensating controls and review dates.

This is not about creating paperwork for its own sake. It gives the assessor a defensible route from a questionnaire response to the systems and records that support it.

Why screenshots and spreadsheets create avoidable risk

Screenshots have a place. They can clarify a specific setting or demonstrate a control in a platform that does not offer a suitable report. But they are weak as the primary evidence source. They are difficult to search, easy to mislabel and rarely show coverage across the full scope.

Spreadsheets create a different problem. They often become the unofficial source of truth for assets, patch status and exceptions, despite being maintained manually and distributed across teams. By the time an audit begins, the security team may be comparing several versions and chasing owners for confirmation. That raises audit effort and reduces confidence just when the organisation needs a clear answer.

The better approach is to generate evidence from the operational data already needed to manage cyber risk. Asset discovery, service visibility, configuration posture, identity data and vulnerability information should agree with one another. Where they do not agree, that discrepancy is itself a risk worth investigating.

For example, an endpoint management platform may report 1,500 managed devices, while network intelligence identifies 1,680 active devices. The 180-device difference should not be buried to preserve a neat compliance figure. It should trigger a scoped investigation: are these printers, unmanaged laptops, contractor devices, operational technology assets or stale observations? Certainty begins with knowing what is connected.

Build evidence continuously, not at renewal time

Cyber Essentials assessment dates are fixed. Your environment is not. New SaaS applications, cloud workloads, user accounts and remote devices can change the risk position every day. A once-a-year evidence exercise can therefore produce an accurate historical snapshot but weak operational assurance.

Continuous evidence changes the model. Instead of asking teams to collect proof at the end of a cycle, establish a repeatable process that refreshes asset, access, configuration and update data. Assign owners to exceptions, set review periods and keep a record of remediation. The result is faster certification preparation, but also faster decisions when a board member, insurer or major customer asks whether the organisation is under control.

This does not mean every control needs the same reporting frequency. Internet-facing exposure and critical vulnerabilities may require daily attention. Privileged access may be reviewed weekly or monthly, depending on the operating model. Lower-risk configuration exceptions may be reviewed on a defined cycle. The right cadence depends on the service, threat exposure and consequence of failure.

A platform such as Rebasoft can support this approach by bringing together asset and service intelligence, configuration posture, identity visibility and vulnerability context. Rather than handing an assessor disconnected exports from several tools, teams can produce evidence that is tied to the assets and business services it represents.

Make evidence useful to leadership as well as assessors

Technical evidence becomes more valuable when it answers business questions. Which exceptions affect customer-facing services? How many unmanaged assets connect to sensitive networks? Is the organisation reducing overdue critical remediation, or simply closing tickets that are easy to resolve?

Board reporting does not need every configuration detail. It needs a concise view of control coverage, material gaps, accountable owners and progress against agreed risk treatment. The supporting evidence should be available when challenged, but the message should remain clear: what is exposed, what has changed and what needs fixing first.

A well-built Cyber Essentials evidence pack does more than support a pass or fail outcome. It gives leadership answers they can trust, reduces the scramble around assurance deadlines and exposes the operational gaps that certification alone cannot fix. Start with the evidence you would want after an incident or a difficult audit question, then make it part of normal security operations.