Cyber Essentials check: would your business pass today?
A free Cyber Essentials checker in two parts. First, 9 questions on this page, four of them on the things that fail an assessment on their own — two-factor login, retired operating systems, the 14-day update rule — answered in about two minutes, with the automatic fails named first. Then the full check, free with an account, covers the other 33 core questions across the five controls and asks about each of your devices and cloud services. Preparation guidance, not a certificate: only a licensed certification body can award one.
The two-minute check
9 questions, 4 of them on the automatic fails — the answers that fail an assessment on their own. Each shows the official question number it comes from. Nothing you answer here leaves your browser.
- 1. A7.16, A7.17For every online tool your business signs into — email, files, accounting, and business social-media accounts — is two-factor login (a code or prompt as well as a password) switched on for every user and every admin?Yes means: Yes, every user and every admin, on every service that offers it. “On for most people” is a no.
- 2. A6.1Are all your devices running an operating system that still gets security updates from its maker — nothing so old it’s been retired? (This includes your router’s built-in software.)Yes means: Yes, every one. Retired today: Windows 10 without Extended Security Updates, Windows 11 versions past their end-of-servicing date (23H2 and earlier; 24H2 Home and Pro from 13 October 2026), macOS 13 Ventura and older, iOS and iPadOS 15 and older, Android 12 and older.
- 3. A6.4When a high-risk or critical security update — or a security update whose severity the maker doesn’t say — comes out for your devices’ operating systems or your router, does it always get installed within 14 days?Yes means: Yes, every time. Automatic updates are the practical way to meet it.
- 4. A6.5When a high-risk or critical security update — or a security update whose severity the maker doesn’t say — comes out for your apps (browsers, office software and the like), does it always get installed within 14 days?Yes means: Yes, every time.
- 5. A4.1Is there a firewall sitting between your office network and the internet — usually the router your internet provider gave you, or a dedicated firewall box?Yes means: Yes. For most small offices the broadband router is the firewall.
- 6. A4.2The admin password for your router or firewall — the one used to change its settings, not your Wi-Fi password — have you changed it from whatever it came with?Yes means: Yes. A default password, even a unique-looking one on a sticker, is a gap until it is changed.
- 7. A5.3Have you changed any default or easy-to-guess passwords on your devices, and do your passwords meet one strong-password rule — two-factor login, at least 12 characters, or at least 8 characters with common passwords blocked?Yes means: Yes to both halves.
- 8. A7.6When someone needs to do admin work — like installing software or changing settings — do they switch to a separate admin account, rather than using their normal everyday account?Yes means: Yes. Everyday accounts should not have admin rights.
- 9. A8.1Is every device protected from viruses and malware — anti-malware software on Windows and Mac computers (Windows Defender counts), and phones and tablets limited to official app-store apps on a list your business has approved?Yes means: Yes, at least one of the two on every device, personal phones used for work included.
What the two-minute check does
The 9 questions above start with the ones that fail an assessment on their own. Four of them are automatic fails in the official question set — an unsupported operating system (A6.1), high-risk, critical or unrated security updates taking longer than 14 days (A6.4 and A6.5), and any cloud account without two-factor login (A7.16 and A7.17) — and the other five cover the firewall, the router’s admin password, default passwords, separate admin accounts and malware protection. A “no” tells you exactly which official question would fail and what fixing it involves. It cannot tell you that you would pass: nine answers, taken on trust, cannot say that, and the result never claims it.
What the full check adds
The official Cyber Essentials questionnaire is written for assessors. It asks about “in-scope end-user devices” and “multi-factor authentication on cloud services”, which is perfectly clear if that is your job and opaque if you run a plumbing firm and a client has just asked for a certificate. The readiness check asks the same things in the words you already use — “does Microsoft 365 ask for a code from your phone as well as a password?” — and maps each answer back to the official question number, so nothing is lost in translation.
At the end you get a verdict for each of the five controls and a list of every gap, ranked worst-first. Anything that would fail the assessment on its own — an unsupported operating system, high-risk or unrated security updates that take longer than 14 days, a cloud account without MFA — is shown in red at the top, because that is what decides the outcome.
The five controls it covers
- User access & MFA — Your logins, admin accounts, passwords, and two-factor (MFA) on your online tools.
- Firewalls & routers — The firewall protecting your network and devices from the internet.
- Secure configuration — How your devices are set up — default passwords, unused software, screen locks.
- Updates & patching — Keeping operating systems and apps updated, and off end-of-life versions.
- Malware protection — Protection against viruses and malicious software.
Before the controls, a short scoping step builds your inventory: the laptops, phones, routers and cloud services that touch work data. Scope is where most surprises live — a personal phone with work email on it, a business LinkedIn account — and the check walks through it with you rather than assuming you already know.
What's free and what's paid
The scoping wizard, the full check, your verdict and the complete gap list are free, forever, with no card — and you can re-run the check any time for free. The paid plan — £149 a year, or £95 for our first 50 customers — adds click-by-click fix guides for each gap on the tools you use, the eleven policy documents drafted from your answers, a draft answer or a clear to-do for every question in the official portal, and quarterly re-check reminders so you stay ready for renewal. See pricing.
What it is not
It is not certification, and a green result is not a pass. Only an IASME-licensed certification body assesses and awards Cyber Essentials; you buy that assessment from them, separately, once you are ready. ReadyCert never connects to your systems or stores credentials — you describe your own setup, exactly as you will in the official self-assessment.
Frequently asked questions
Is the readiness check really free?
Yes. The scoping wizard, the full check across all five controls, your verdict and the complete list of gaps are free, with no card needed. The paid plan adds fix guides, drafted policies and the answer pack.
How long does it take?
About ten minutes for a business of five to fifty people, once you know roughly what devices and cloud services you use. You can stop part-way and come back; answers save when you finish a section.
Is this a gap analysis?
In effect, yes. It asks the same things the official questionnaire asks, in plain English, and shows you every gap ranked worst-first — with the automatic fails flagged before anything else.
Does it connect to my Microsoft or Google account?
No. You describe your own setup and ReadyCert never connects to your systems or stores credentials. It is self-attestation, the same as the official assessment.
Will a green result mean I'll pass?
No tool can promise that. The check is preparation guidance: it finds the answers that would fail and tells you how to fix them. Certification is assessed and awarded only by an IASME-licensed certification body.