--- title: Cyber Essentials Evendine Question Set description: IASME is bringing in a new question set and marking scheme for 2022. These changes will affect both Cyber Essentials and Cyber Essentials PLUS. If you begin an assessment on or after 24th January 2022, it will be marked against the Evendine scheme. image: https://csacyber.com/hubfs/images-13.png --- [Skip to content](https://csacyber.com/blog/cyber-essentials-evendine-question-set#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search December 20, 2022 6 min read time # Cyber Essentials Evendine Question Set ![Cyber Security Associates](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Cyber Security Associates -](https://csacyber.com/blog/author/cyber-security-associates) [Consultancy](https://csacyber.com/blog/tag/consultancy) ![](https://csacyber.com/hubfs/images-13.png) IASME is bringing in a new question set and marking scheme for 2022. These changes will affect both Cyber Essentials and Cyber Essentials PLUS. If you begin an assessment on or after 24th January 2022, it will be marked against the Evendine scheme. Existing Beacon assessments will not be affected, and you will still be allowed to complete Cyber Essentials under the 2021 Beacon scheme if the assessment was started before 24th January 2022. As always, IASME allows 6 months from the commencement of an assessment to submit your answers, whether marked under Beacon or Evendine. The advice in this blog post is based on the guidance IASME has released so far and will be updated if and when any new information is provided. | | Beacon (2021) | Evendine (2022) | | --- | --- | --- | | **Scope Definition** | A device is in scope if it has access to both the Internet and company data. | A device is in scope if it meets at least one of the following conditions: - It can accept incoming network connections from untrusted Internet-connected hosts - It can establish user-initiated outbound connections to devices via the Internet - It controls the flow of data between any of the above devices and the Internet All applications must now include the number of End-User devices in the scope. Scopes such as Azure-only, or DMZ-only are no longer acceptable and will not achieve compliance. | | De-scoping devices | Permissible to de-scope devices by using firewall rules to block Internet traffic to and from one or more devices | Individual firewall rules are no longer an acceptable method to de-scope devices. Sub-sets (defined as a part of the organization whose network is segregated from the rest of the org by a firewall or VLAN) are used to determine scope. If one device in a sub-set is in scope, all devices in that sub-set will also be included in the scope. Devices which an applicant would like to de-scope must be placed in a separate subset, i.e. in a segregated VLAN or behind a dedicated firewall. | | Thin Clients | Not required to be in scope | 1 YEAR GRACE PERIOD: From Jan 2022 – Jan 2023: in scope, but questions are informational only. This will not cause an application to fail if insecurely configured. From Jan 2023 onwards: in scope, must be supported and receiving security updates | | Cloud Services | Left up to the applicant to decide whether in scope | Always included in the scope: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) | | Unsupported Software | Unsupported software causes a major non-compliance, which increases the likelihood of an overall fail if other areas of the scope are also non-compliant | 1 YEAR GRACE PERIOD: From Jan 2022 – Jan 2023: unsupported software will attract two major non-compliances, which means the rest of the scope must be compliant to avoid a Fail. From Jan 2023: Unsupported software found on an in-scope device will cause an automatic fail. | | Home workers | Networks controlled by home workers (e.g. home broadband and associated routers) were originally in-scope. This involved configuration checks such as ensuring all home-workers had changed their default home router password | Home-workers’ personal home networks are now explicitly excluded from the scope. This is due to potential legal concerns under GDPR, as details of ISP-provided home routers can be considered personally Identifying Information (PII). Corporate-provided routers are in-scope. Home workers’ devices (i.e. workstations and mobile devices) are still in scope. Home workers will rely on either their software firewalls on their corporate device(s), or the use of a corporate VPN. | | Device Locking | N/A | This is a new section: device locking is now included with in secure configuration control. Acceptable locks for a device are PINs, biometrics, and passwords. If this lock is solely used to unlock the device, the minimum length of PIN or password is 6 digits or characters, respectively. When the credentials are used elsewhere (e.g. a Windows SSO password), the full password requirements must be applied – see “Password Requirements” section below. | | Password Requirements | Passwords must be 8 characters long and difficult to guess | Accounts must be protected against brute-forcing with one or more of the following: - Multi-factor authentication - Account lockout - Login Throttling The minimum password length is 8 characters if one or both of the following apply: - MFA (Multi Factor Authentication) is used - Common passwords are disallowed If neither of the above solutions is in place, the minimum password length is 12 characters | | Bring-Your-Own-Device (BYOD) Mobile Devices | | A BYOD device is not in scope if it is used solely for native voice (i.e. telephone) applications, text (i.e. SMS) applications, MFA applications, or a combination of these. Use of non-native telephone or SMS apps, such as WhatsApp, for business use will bring the BYOD device back into scope. | | Security Update Management | | All in-scope software must be: - licensed - supported - removed from devices when they become unsupported OR the device removed from scope by using a defined subset that prevents all traffic to and from the Internet - have automatic updates enabled where possible - critical updates must be applied within 14 days Firmware will also be expected to be up to date as well | | Backups | N/A | This is a new section intended to encourage good practice or highlight areas where backup procedures could be added or improved. The questions are informational only, and your answers will not cause you to fail the assessment, although this may change in future questions sets. | ### Main Changes to Expect – Cyber Essentials PLUS Your CE+ assessor will now need to conduct two additional tests. These are: - Confirming the separation between user and admin accounts - Confirming that MFA is applied to cloud services: - Until January 2023, this test will be applied only to admin accounts on cloud services - After January 2023, this will be applied to all accounts (user and admin) on cloud services - IASME strongly recommend that the grace period of one year be used to roll out MFA to all user accounts Please be aware that the Pass criteria for the Patch Audit will also be changing. From 24th January 2022, any missing patches with a CVSSv3 of 7.0 or above will cause an automatic failure. Previously, mitigating circumstances for missing patches were considered, however these will no longer be allowed with the new CE+ process. ### Summary ##### Cyber Essentials Basic Changes Stricter guidelines for: - Scope definition and how to de-scope devices - Cloud services and thin clients are now required to be in scope - Which network equipment for homeworkers can be included from the scope - Password Requirements - Bring-Your-Own-Device Mobile Devices IASME allowing a grace period before cracking down on: - Multi-factor authentication for all user accounts on cloud services (12-month grace period to allow configuration) - Unsupported software will increase the likelihood of an overall fail for 12 months after the initial question set release, then cause an automatic fail after that - Thin clients – after 12 months from release of the question set, thin clients must be supported and receiving security updates New sections: - Backups (informational questions only, will not cause a fail) - Device locking   ##### Cyber Essentials PLUS Two new tests: - Confirming the separation between user and admin accounts - Confirming that MFA is applied to cloud services   Patch Audit applying stricter guidelines to what constitutes a Fail Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Untitled%20design.jpg?width=624&height=427&name=Untitled%20design.jpg)](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) August 20, 2026 9 min read ### [CSA Cyber and FluidOne named as suppliers on G-Cloud 15](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) CSA Cyber (CSA), part of the FluidOne Group, has been named as a supplier on Government Commercial... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Engineered%20to%20Endure%20Campaign%20Assets%20(2).png?width=624&height=427&name=Engineered%20to%20Endure%20Campaign%20Assets%20(2).png)](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) August 20, 2026 6 min read ### [Why organisations lose security visibility without realising it](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) Before an organisation can understand risk, maintain control or respond effectively to emerging... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cyber Security Associates", "url" : "https://csacyber.com/blog/author/cyber-security-associates" }, "dateModified" : "2024-12-07T12:31:29.532Z", "datePublished" : "2022-12-20T05:15:00.000Z", "headline" : "Cyber Essentials Evendine Question Set", "image" : [ "https://csacyber.com/hubfs/images-13.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/cyber-essentials-evendine-question-set", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```