Cyber Essentials
Ready for assessment?
Find out in five minutes.
Cyber Essentials changed in April 2026. The Danzell question set makes missing MFA on cloud services and slow patching automatic fails, and pulls every cloud service and internet-connected device into scope. Check where you stand before you apply.
Where do you stand?
Sixteen questions. One picture.
Five minutes against the current Cyber Essentials requirements (the Danzell question set, version 3.3, in force since 26 April 2026). Answer honestly and the mark assembles as you go. Nothing leaves your browser unless you choose to send us the summary.
Fix first
Indicative only. This is not an assessment and does not predict a certification outcome. Certification is carried out by a licensed certification body under IASME; we help you get ready for it. Requirements summarised from the NCSC Cyber Essentials: Requirements for IT infrastructure v3.3 (opens in a new tab) and the IASME April 2026 update (opens in a new tab).
How we get you ready
We close the gaps. A licensed certification body does the certifying.
We help you understand the requirements, identify gaps and make the technical changes needed to prepare for Cyber Essentials or Cyber Essentials Plus. We can lead the readiness work directly or support your existing team and IT provider.
- Up to date with Danzell. The version 3.3 question set has applied since 26 April 2026. Multi-factor authentication on every cloud service that offers it, and 14-day patching of critical updates, are now automatic fails rather than non-compliances.
- MFA and passwordless done properly. Rolling out authenticator apps, passkeys and FIDO2 security keys across Microsoft 365, Google Workspace and your other cloud services, with separate, properly protected admin accounts.
- Scope you can defend. Cloud services can no longer be excluded, all internet-connected devices are in by default, and the new questions on legal entities, addresses and headcount need straight answers.
- Evidence, then the application. Patching records, MFA reports, device lists and firewall settings gathered so the self-assessment is answered from evidence. For Cyber Essentials Plus, a dry run of the technical checks before the assessor arrives.
Readiness support does not include certification. Assessment and certification are carried out by a licensed certification body under IASME.
Already certified and carrying pentest findings instead? Start remediation — the same team, the same care with your evidence.