Is your business actually ready for Cyber Essentials?
The rules changed in April 2026 (the "Danzell" update to v3.3), and the most common reasons businesses fail are now things most checklists don't ask about: MFA on free cloud tools, the 14-day critical patch rule, and how remote or multi-entity setups get scoped.
05 min
Free, instant result. No certificate upsell.
Independent
Not a certification body. Advisory, not a sales funnel.
2026 rules
Written against the current v3.3 "Danzell" question set.
Standard or Plus?
Both certify the same five control areas. The difference is who checks your answers.
Cyber Essentials
A self-assessment questionnaire, signed off by a director and verified by a certification body. The usual starting point, and what most small contracts and insurers ask for.
Our free check tells you where the gaps probably are before you pay for an assessment.
Take the standard checkCyber Essentials Plus
The same controls, plus a hands-on technical audit by a certified assessor. Often asked for in NHS and public sector work. Preparing well is the difference between passing on the day and a re-test.
- External scan: internet-facing IPs and services.
- Internal scan: a sample of representative devices.
- Build standard: patch levels, config, local admin rights.
The standard check walks through MFA scope, the 14-day patch rule, and assessment scoping, with plain-English guidance on any gaps. Because this isn't a certification-body sales funnel, it routes you to a free advisory call, not a certificate upsell.
Why trust this check
Most businesses don't find out what's actually missing until an assessor, an insurer, or an attacker tells them. This exists so you find out first. See the privacy policy for how your data is used.