What is a Cyber Essentials readiness check?
A Cyber Essentials readiness check (sometimes called a readiness assessment) is a short self-test that shows whether your organisation would meet the Cyber Essentials requirements today, before you pay for certification. It covers the same ground as the real assessment (your scope and the five technical controls) and turns every gap into a fix you can act on.
The certification itself is an online self-assessment: you answer IASME's Danzell question set, and an assessor at a licensed certification body marks your answers against the NCSC's Requirements for IT Infrastructure v3.3. That questionnaire is longer and asks for detail such as device models and operating system versions. This check condenses it into 20 questions on the core requirements. It is not a substitute for the real questionnaire, but any gap it finds will be a gap there too.
How is the readiness score worked out?
Each question is weighted by how much it matters to the outcome. Questions that fail an assessment on their own under the April 2026 rules count three times, requirements an assessor is very likely to reject count twice, and the rest count once. "No" and "Unsure" both score zero, because an assessor can only accept what you can confirm.
| Your result | What it means | Suggested next step |
|---|---|---|
| 100% | Ready to submit: no gaps found | Bronze package if you are confident, or Silver for a 48-hour assessment and three resubmissions |
| 80 to 99% with no automatic-fail gaps | Nearly ready: a few fixes left | Close the gaps on your fix list, then Silver |
| 50 to 79%, or any automatic-fail gap | Work to do before you submit | Fix automatic fails first, then Gold for unlimited resubmissions and three months to pass |
| Below 50% | Not ready yet | A gap analysis with our Cyber Essentials consultancy team, then Gold |
Package details and prices for every company size are on our Cyber Essentials cost page.
Which gaps fail Cyber Essentials automatically?
Three answers fail a Cyber Essentials assessment on their own, however well you do elsewhere. For assessment accounts created after 26 April 2026, IASME treats these as automatic failures:
- MFA missing on a cloud service that offers it, for any user.
- High-risk or critical updates for operating systems, or for router and firewall firmware, not installed within 14 days of release.
- High-risk or critical updates for applications, including associated files and extensions, not installed within 14 days.
The same update also made clear that cloud services cannot be excluded from scope, so every online service holding your data must meet the MFA rule. Unsupported software is close behind: anything its vendor no longer supports must be removed or isolated from the internet. Microsoft ended support for Windows 10 on 14 October 2025, so any Windows 10 device needs Extended Security Updates or an upgrade to stay in scope.
How long does it take to fix the gaps?
Most gaps are settings changes that take hours or days; replacing unsupported hardware takes longest. Start with the slow items so they don't hold up your submission.
| Gap found | Usual fix | Usual effort |
|---|---|---|
| MFA missing on a cloud service | Enforce MFA for every user, including admin and IT provider accounts | Days (users need to enrol) |
| Unsupported operating system or software | Upgrade, buy extended support or retire the device | Weeks if hardware must be replaced |
| Updates older than 14 days | Automatic updates, plus a routine for firmware and third-party apps | Days, then an ongoing process |
| Personal devices (BYOD) not controlled | Enrol them in device management, or block them from company data | Days to weeks |
| Default passwords on routers, printers or storage | Change them and record each device's make and model | Hours |
| Admins using admin accounts for email | Create separate admin accounts | Hours |
Once you submit, assessment is fast: within one working day on our Gold package, two on Silver and three to five on Bronze.
Is a readiness check the same as a Cyber Essentials gap analysis?
No. This check is a five-minute self-test: you answer, it scores. A gap analysis is done by a person, who reviews your scope, devices and cloud services against every requirement and gives you a written, prioritised list of what to change and the evidence an assessor will expect.
If you scored below 50%, have no in-house IT or have a bid deadline, a gap analysis from our Cyber Essentials consultancy team is usually quicker than trial and error. We advise within IASME's independence rules for certification bodies: we tell you what needs to change, and your team or IT provider makes the change.
Cyber Essentials Plus readiness: does a good score mean you're ready?
Not on its own. Cyber Essentials Plus tests the same five controls technically: an assessor scans your external IP addresses, runs authenticated vulnerability scans on a sample of devices, checks malware protection with test files and verifies MFA on your cloud services. It must be completed within three months of your Cyber Essentials certificate.
Since April 2026, if a Plus test fails, the retest covers the original sample and a new random sample of devices, so fixes need to be applied everywhere rather than only on the devices tested. Use our Cyber Essentials Plus requirements to prepare, and see Cyber Essentials Plus cost for how it is priced.
What should you do after the readiness check?
- Fix automatic fails first: MFA on every cloud service and the 14-day update rule.
- Work through the rest of your fix list, using our Cyber Essentials checklist for the detail and evidence behind each requirement.
- Preview the questions on our Cyber Essentials questionnaire page and draft your answers offline.
- Confirm your scope with our scoping questionnaire if you have several sites, home workers or plan to go on to Plus.
- Choose a package and submit. Every package includes a pre-assessment check, so your answers are reviewed before formal submission.
Still deciding whether you need certification at all? Our Cyber Essentials FAQs cover who needs it, how long it takes and what it costs.
Why Sovereign Secure?
Sovereign Secure Ltd is an IASME-licensed certification body that assesses and issues Cyber Essentials and Cyber Essentials Plus certificates. We are also ISO 27001 certified, a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
Cyber Essentials certification packages start from £320 + VAT for organisations with up to 9 employees, and every package includes a pre-assessment check, a support call of up to an hour, guide access and the certification fee. Found gaps you can't close alone? Call +44 161 523 5276 or send us a message below.
Last reviewed September 2026 by the Sovereign Secure assessment team, against the NCSC Requirements for IT Infrastructure v3.3.
