This is the control set we assess UK organisations against. We publish it so you can see exactly what is being asked of you before you engage us, and so you can work through it yourself if you would rather not.
What this is, and what it is not
Thirty-six governance controls, not a certification
UK Cyber-Safe is not an accredited certification body and this is not a certification scheme. It is the set of questions we work through, the evidence we ask to see, and what each control relates to in UK law.
It sits above the technical baseline rather than replacing it. For technical controls we reference the NCSC’s Cyber Essentials scheme, which is the UK Government-backed baseline your customers, insurers and public-sector buyers already ask you about. There is no sense in us inventing a competing one.
Version 1.0 · August 2026 · Reviewed at least annually against changes in UK law.
Accountability and ownership
4 controlsOne named individual is accountable for cyber security and privacy.
Evidence A role description, contract clause or board minute that names them.
UK GDPR Art 5(2) · Art 37 DPO where required
The board, owner or executive receives a cyber and privacy report at a stated cadence.
Evidence Two consecutive board packs or sets of minutes showing it actually happened.
Decision authority is defined for security decisions that disrupt the business.
Evidence A written statement of who can authorise emergency patching, isolating a system or taking a service offline, including out of hours.
Cyber and privacy work has an identified budget.
Evidence A budget line or extract. It may be small, but it must exist.
What matters and what could hurt
4 controlsThere is a written list of the systems and data whose loss or exposure would materially damage the business.
Evidence The list, dated, reviewed within twelve months. Most organisations have never written this down, which is why every risk looks the same size.
A risk register exists, with named owners and review dates.
Evidence The register.
Risks that have been accepted are recorded, with who accepted them and when.
Evidence Register entries showing an acceptance decision, not a blank status column.
There is an inventory of systems that hold personal information.
Evidence The inventory.
UK GDPR Art 32
Privacy obligations
5 controlsA breach register records every personal data breach, including those judged not to be reportable to the ICO, with the facts, the effects and the remedial action taken.
Evidence The register itself.
UK GDPR Art 33(5)
A documented process decides whether a breach must be reported to the ICO (a risk to people’s rights and freedoms) and whether the people affected must also be told (a high risk).
Evidence The process, and a worked example if a breach has occurred.
UK GDPR
A privacy notice states what is collected, why, how long it is kept and how to complain.
Evidence The published notice.
UK GDPR Arts 5(1)(a)–(b), 13 and 14
Retention periods are defined and actually enforced.
Evidence A retention schedule plus evidence that deletion has happened. A published period nobody executes is worse than none.
UK GDPR Art 5(1)(b) and (e)
Where personal data of people in the EU is handled, EU GDPR obligations are identified and assigned alongside the UK ones.
Evidence A dated assessment note.
EU GDPR
Technical baseline
4 controlsThe organisation can evidence its position against the five Cyber Essentials controls.
Evidence A completed, dated baseline self-assessment. We assess governance. This is the technical floor beneath it and we do not restate it.
Cyber Essentials
Multi-factor authentication is enforced on email, remote access and administrative accounts.
Evidence Configuration evidence, or a signed attestation from whoever administers it.
Cyber Essentials: user access control
Backups exist, are protected from the systems they protect, and a restore has been tested in the last twelve months.
Evidence The restore test record. An untested backup is a hope, not a control.
NCSC 10 Steps: data security
Patching is managed and exceptions are recorded.
Evidence A patch status report, and the list of what cannot be patched with the reason why.
Cyber Essentials: security update management
Third parties and supply chain
4 controlsThere is an inventory of third parties with access to systems or personal information.
Evidence The inventory.
Due diligence is carried out before contracting, proportionate to risk and criticality.
Evidence Completed reviews for the most critical suppliers.
PRA SS2/21 where applicable
Third parties are reviewed on an ongoing basis, not only at onboarding.
Evidence Dated review records from after the contract start.
PRA SS2/21 where applicable
Where a supplier subcontracts, the organisation knows who the subcontractor is.
Evidence A contract clause requiring disclosure, or a supplier attestation naming them.
AI deployment governance
5 controlsThere is an inventory of AI tools and features in use, including those switched on inside products you already own.
Evidence The inventory, dated. The features nobody decided to adopt are the ones that catch people out.
AI deployments are reviewed before they go live, against a defined set of questions.
Evidence Completed pre-deployment reviews.
What each AI system can reach is documented and deliberately scoped.
Evidence A record of the data and permissions each system inherits.
Decisions made exclusively by automated processing are identified, and where they concern individuals the required information is given.
Evidence A register of automated decisions, and the notice provided to people.
UK GDPR Art 22 · DUAA 2025
Human oversight is defined for each AI system that affects people.
Evidence A named reviewer who is in a position to change the answer, and the route for someone to ask.
UK GDPR Art 22 · DUAA 2025
Incident readiness
4 controlsA written incident response plan exists, with contact details that are current.
Evidence The plan, with a review date inside twelve months.
NCSC 10 Steps: incident management
The plan names who decides, including out of hours and when that person is unavailable.
Evidence The named roles and the escalation path.
The plan has been exercised in the last twelve months.
Evidence An exercise record, including what did not work.
There is a defined route to breach notification decisions, including the ICO and affected individuals.
Evidence The decision path, and who signs it off.
UK GDPR
People
3 controlsSecurity and privacy awareness training is delivered and completion is recorded.
Evidence Completion records, not a purchase order for a training platform.
NCSC 10 Steps: engagement and training
Access is removed promptly when someone leaves or changes role.
Evidence A sample of recent leavers showing the date access ended.
Cyber Essentials: user access control
People know how to report something suspicious, and are not penalised for reporting it.
Evidence The reporting route, and evidence it has been used.
Evidence and review
3 controlsEvidence for these controls is held in one place and can be retrieved.
Evidence The repository, and someone who can find things in it.
The control set is reviewed at least annually against changes in UK law.
Evidence A dated review note.
The organisation can produce a dated summary for a customer, an insurer or a regulator on request.
Evidence The most recent summary. This is the point of all of it.
The control set is what we assess against, and we do not then fix what we find. Why the practice is built that way, and who carries out the assessment.
Work through it with us
Most organisations find they can evidence about a third of this on the first pass. That is normal, and it is a more useful starting point than a score. An independent assessment against this set is typically £3,200–£4,800 + VAT depending on scope, and the first conversation costs nothing.