The MFA gap checker
MFA is the control that decides most Cyber Essentials results: one cloud account without it fails the whole user-access section. Tick the services your business signs into, answer one question per tool, and see exactly where you stand — in your browser, with nothing uploaded.
Check your tools
1. Tick every service the business signs into. 2. For each, answer one question: is two-factor login on for every account — admins included? Nothing you tick here leaves your browser.
Email, files & office
Accounting & money
Customers & projects
Communication
Marketing, design & web
Business social accounts
HR & operations
Anything else you sign into
Why this one control gets its own checker
The 2026 question set asks about MFA four times (A7.14 to A7.17), and three of those are automatic fails. The rule is simple to state — MFA on for every user and every admin of every cloud service that offers it — and easy to fail in practice, because businesses rarely miss it on their main email. They miss it on the accounting tool set up years ago, the shared social-media login, the one design app a single person uses. The hard part is not switching MFA on; it is knowing the full list of places to check.
That is what the checker above does. The 33 services in it are the tools UK small businesses actually run on, and every one of them offers MFA (self-hosted WordPress through a two-factor plugin) — the list mirrors the per-tool fix guides inside ReadyCert, which is how we know. So for anything you tick, “this tool can’t do it” is never the answer, and the only question left is the honest one: is it on for everyone?
How to answer accurately
- “On for everyone” means verified, not remembered. Most services show an enrolment or security report in their admin area. Look before you tick.
- Admins count double. The questionnaire asks about administrators separately — including any login your IT provider uses on your behalf.
- Shared logins hide gaps. An info@ mailbox three people use is one account — and it needs MFA like any other. (It is also its own gap: everyone should have their own login.)
- “Not sure” is a to-do, not a maybe. On the questionnaire there is no “not sure” — by submission day every answer here should be a confirmed yes.
What to do with the gaps
Work through them tool by tool — each takes about ten minutes per person. The switch lives in the account security settings of each service; for the two suites where most businesses live we have click-by-click guides (Microsoft 365, Google Workspace), and the MFA guide covers what counts as MFA and the A7.15 trap for tools that genuinely lack it. Prefer an authenticator app or passkey over text-message codes.
Frequently asked questions
Which accounts need MFA for Cyber Essentials?
Every user and every administrator of every cloud service that offers MFA — email, files, accounting, CRM, comms, marketing tools and business social-media accounts alike. One account without it fails the whole user-access section (questions A7.16 and A7.17).
How do I know if a service offers MFA?
Every service in this checker offers it (self-hosted WordPress through a two-factor plugin) — the list mirrors the per-tool guides in the ReadyCert app, which is how we know. For a tool not in the list, check its account security settings, and confirm with the provider before ever claiming it has no MFA option: listing a service that can do MFA at question A7.15 is an automatic fail.
Does “MFA on” mean on for admins, or everyone?
Everyone. The questionnaire asks about administrators (A7.16) and all other users (A7.17) separately, and both must be yes. “On for most people” is a no.
Is what I tick here stored anywhere?
No. The checker runs in your browser; nothing you select is sent to ReadyCert or saved after you leave the page.