Cyber Essentials Plus Readiness Assessment
Assess your organisation’s readiness for Cyber Essentials Plus certification across all five technical controls and get a prioritised action plan.
Your Technical Controls
Firewalls & Internet Gateways
Secure Configuration
User Access Control
Malware Protection
Patch Management
Cyber Essentials Plus - Five Technical Controls
| Control Area | What’s Assessed | Common Fail Points | CE+ Requirement Level |
|---|---|---|---|
| Firewalls & Internet Gateways | Boundary firewalls, rules, default deny | Open ports, default rules | All rules documented and justified |
| Secure Configuration | Default passwords, unnecessary services | Factory defaults, bloatware | CIS benchmarked or equivalent |
| User Access Control | Admin privileges, user accounts | Shared accounts, no MFA | Individual accounts, MFA, least privilege |
| Malware Protection | Antivirus, endpoint protection | Outdated signatures, no EDR | Real-time protection, current signatures |
| Patch Management | OS updates, third-party apps, EOL | Delayed patches, EOL software | Critical patches within 14 days, no EOL |
Based on the NCSC Cyber Essentials scheme requirements. This tool is for guidance only and does not replace an official certification assessment. Contact Cloudswitched to start your Cyber Essentials Plus certification journey.
More Free Tools
Try our other free security assessments and IT planning tools.
Frequently asked questions
Cyber Essentials Plus is a UK government-backed certification that verifies your organisation's cyber security controls through hands-on technical testing, not just a self-assessment questionnaire. Many UK government contracts, insurers, and larger clients require it before they'll work with you. Most SMEs pursue it to win contracts, cut cyber insurance premiums, and prove credible security practices to customers.
Readiness depends on five technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. Most UK SMEs need 4-8 weeks to close gaps before the audit. This calculator scores your current setup against each control area and flags the gaps most likely to cause a failed assessment.
The five controls are firewalls and internet gateways, secure configuration of devices and software, user access control (least privilege), malware protection, and security update (patch) management. Assessors test all five during Cyber Essentials Plus. Weak patching and missing multi-factor authentication on admin accounts are the two areas most UK SMEs fail on first attempt.
For a typical UK SME with reasonable IT hygiene, expect 6-12 weeks from starting remediation to receiving certification, including a self-assessment questionnaire stage followed by the technical audit. Businesses with legacy systems, unmanaged devices, or BYOD policies often need longer to remediate before booking the assessment date.
