Are you ready for Cyber Essentials?
Twenty-eight plain-English questions, based on the official 2026 Cyber Essentials question set. You'll get a readiness score, a control-by-control view of where you stand, and a short list of what to fix first.
What the check is, and isn't
It's a quick, honest self-check built from the official Cyber Essentials question set. It isn't the assessment itself, and it can't give you a certificate.
Every question here maps to the official question set (Danzell, version 16.3, May 2026), which is based on the NCSC's Requirements for IT Infrastructure v3.3. The real assessment asks you to describe your setup in more detail, it's checked by a certification body, and a director signs it off. This check turns the yes or no parts into plain English, so you can see where you stand before you start. Open Why this matters on any question to see which official questions it covers.
How the score works. Each Yes scores a full point, each Partly half a point, and No or Not sure scores nothing. A few answers are must-haves, such as multi-factor authentication and supported software. If any of those aren't a clear Yes, the result says so, whatever your score, because the real assessment is pass or fail.
Be honest with yourself. In the real assessment, partly usually counts as no. Not sure is a perfectly good answer here, and the results will tell you what to go and find out.
Want the background first? Read what Cyber Essentials covers, what it costs, or how to turn on multi-factor authentication, the 2026 rule that trips up the most people.
Readiness check questions
Is this the official Cyber Essentials assessment?
No. The official assessment is completed through IASME, the scheme's delivery partner for the National Cyber Security Centre, and checked by a licensed certification body. This is a free self-check to help you see how ready you are before you apply.
If I score 100, will I pass?
It's a very good sign, but not a guarantee. The real question set goes into more detail, and assessors look for specifics, such as exactly which devices are in scope. A score of 100 means you've got every yes or no requirement covered, including all the automatic fails.
What's an automatic fail?
The official question set names a few answers that fail the assessment on their own, however good the rest are: multi-factor authentication missing for any user or admin on a cloud service that offers it, high and critical updates not always installed within 14 days (for operating systems, router firmware and apps), and any operating system that's no longer supported, such as Windows 10 without Extended Security Updates.
Do personal phones and laptops count?
Yes, if they're used to access your business data or services, including just checking work email. Staff devices can't be left out of scope, so they need to meet the same rules, including a supported operating system and approved apps only.
Do you see my answers?
No. The check runs entirely in your browser and nothing you answer is sent anywhere, including to fromIT. If you'd like a second opinion, you can copy your results and share them yourself.
How long does it take to get certified?
For most organisations, a few weeks from first call to certificate. It depends on how much needs fixing first. Your results here are a good guide to how much work that is.
Want a second pair of eyes?
Book a 30 minute call and I'll go through your results with you, tell you honestly what matters most, and what it would take to get you certified.