Assess your organisation’s readiness for Cyber Essentials Plus certification across all five technical controls and get a prioritised action plan.
| Control Area | What’s Assessed | Common Fail Points | CE+ Requirement Level |
|---|---|---|---|
| Firewalls & Internet Gateways | Boundary firewalls, rules, default deny | Open ports, default rules | All rules documented and justified |
| Secure Configuration | Default passwords, unnecessary services | Factory defaults, bloatware | CIS benchmarked or equivalent |
| User Access Control | Admin privileges, user accounts | Shared accounts, no MFA | Individual accounts, MFA, least privilege |
| Malware Protection | Antivirus, endpoint protection | Outdated signatures, no EDR | Real-time protection, current signatures |
| Patch Management | OS updates, third-party apps, EOL | Delayed patches, EOL software | Critical patches within 14 days, no EOL |
Based on the NCSC Cyber Essentials scheme requirements. This tool is for guidance only and does not replace an official certification assessment. Contact Cloudswitched to start your Cyber Essentials Plus certification journey.
Try our other free security assessments and IT planning tools.
Cyber Essentials Plus is a UK government-backed certification that verifies your organisation's cyber security controls through hands-on technical testing, not just a self-assessment questionnaire. Many UK government contracts, insurers, and larger clients require it before they'll work with you. Most SMEs pursue it to win contracts, cut cyber insurance premiums, and prove credible security practices to customers.
Readiness depends on five technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. Most UK SMEs need 4-8 weeks to close gaps before the audit. This calculator scores your current setup against each control area and flags the gaps most likely to cause a failed assessment.
The five controls are firewalls and internet gateways, secure configuration of devices and software, user access control (least privilege), malware protection, and security update (patch) management. Assessors test all five during Cyber Essentials Plus. Weak patching and missing multi-factor authentication on admin accounts are the two areas most UK SMEs fail on first attempt.
For a typical UK SME with reasonable IT hygiene, expect 6-12 weeks from starting remediation to receiving certification, including a self-assessment questionnaire stage followed by the technical audit. Businesses with legacy systems, unmanaged devices, or BYOD policies often need longer to remediate before booking the assessment date.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
18 Sep, 2026
A backup retention policy is the answer to a question most UK businesses have never actually been asked: how far back do you need to be able to go? In the...
17 Sep, 2026
Multi-site network design is the decision most UK businesses make by accident. The second office gets a site-to-site VPN back to head office because that is...
16 Sep, 2026
Azure cost management is the discipline that stands between a UK business and the invoice nobody expected. The uncomfortable part is that the invoice is almost...