Free tool – Cyber Essentials Readiness
Are You Ready for Cyber Essentials?
Cyber Essentials is the UK Government-backed standard built around five technical controls, designed to protect against the most common cyber attacks. Work through the checklist to see how ready you are and exactly where the gaps are.
Free, no sign-up required
Based on the official NCSC / IASME control themes
Takes about two minutes
For each item choose Yes, No or Not sure. Answer for the devices, cloud services and accounts your organisation actually uses.
Firewalls
Do you have a firewall enabled on your internet router and on every device that connects to the internet?
Have the default admin passwords on your firewall and router been changed from the manufacturer default?
Secure Configuration
Are unnecessary user accounts, software and services removed or disabled on your devices?
Does every user account require a password to log in, with default passwords changed?
Is auto-run for removable media (USB drives etc.) disabled across your devices?
Security Update Management
Are all operating systems and software kept up to date with the latest security updates?
Is unsupported software (past its end-of-life date) removed or replaced?
Are critical or high-risk security updates applied within 14 days of release?
User Access Control
Do users only have the access rights they need to do their job (least privilege)?
Is multi-factor authentication (MFA) enabled on cloud services, email and admin accounts?
Are administrator accounts used only for admin tasks, never for everyday work like email or browsing?
Malware Protection
Is antivirus or anti-malware software installed and kept up to date on all devices?
Are app installs and downloads restricted to approved app stores or a defined allow-list?
A self-assessment guide, not the official questionnaire or a pass/fail result. Cyber Essentials is administered by IASME on behalf of the NCSC and is refreshed regularly. Backups are strongly recommended good practice but are not one of the five scored technical controls. Blowfish Technology can take you through the full certification assessment and remediation, including Cyber Essentials Plus.
Cyber Essentials: Your Questions Answered
Quick answers on the scheme, the costs and what happens after you check your readiness.
What is Cyber Essentials?
Cyber Essentials is a UK Government-backed certification scheme, run by the National Cyber Security Centre (NCSC) and delivered through the IASME consortium. It assesses five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both assess the same five controls. Cyber Essentials is a self-assessment questionnaire that is reviewed by a certification body. Cyber Essentials Plus adds independent technical testing by an assessor to confirm the controls work in practice, which gives a higher level of assurance.
Do we have to have Cyber Essentials?
It is not a legal requirement for most businesses. It is often required for UK government contracts that involve sensitive or personal data, and more and more customers and insurers ask for it when they review their suppliers.
How much does Cyber Essentials cost?
According to the NCSC, the Cyber Essentials assessment fee is tiered by organisation size and starts at 320 pounds plus VAT. Cyber Essentials Plus is quoted based on the size and complexity of your network. Any remediation work and support come on top, so contact us for a quote for your business.
Do we get cyber insurance with Cyber Essentials?
According to the NCSC, UK organisations with a turnover under 20 million pounds that certify their whole organisation automatically receive Cyber Liability Insurance arranged by IASME, including 24/7 incident response support.
How long does a Cyber Essentials certificate last?
A certificate is valid for 12 months, so you renew every year. Cyber Essentials Plus has to be completed within three months of your Cyber Essentials certificate.
How is my readiness score calculated?
Each Yes scores one point, each Not sure scores half a point and each No scores nothing. Your percentage is your points divided by the 13 questions. It is a self-assessment guide for planning, not the official questionnaire and not a pass or fail result.
What if my score is low?
That is common, and it is exactly what the checker is for. The results show which of the five controls need work. Blowfish Technology can run a gap analysis, fix the gaps and guide you through certification. Get in touch and we will talk through the next steps.
Ready to Get Certified?
Talk to Blowfish Technology about Cyber Essentials and Cyber Essentials Plus certification for your business.