Cyber Essentials Readiness
101 questions across the five technical controls, and the scoping decision that sinks most applications.
101 controls · 6 pillars · 23 categories · evidence can be collected automatically
101 questions across the five technical controls, and the scoping decision that sinks most applications.
101 controls · 6 pillars · 23 categories · evidence can be collected automatically
Cyber Essentials is the floor for selling to UK government, and increasingly for sitting anywhere in that supply chain. The declaration is signed by a board-level officer on behalf of the whole organisation, which means somebody is personally asserting a set of facts about every device and cloud service in use. This review establishes whether those facts hold, before the signature goes on.
101 questions in six sections, scored one at a time with an assessor: scope, assets and backups (25), firewalls (13), secure configuration (12), security update management (14), user access control (24) and malware protection (13). A read-only collector covers part of it and the rest is interview and document-led, so nothing is installed in your estate and no production change is needed to run it. The output is a per-question score and a gap list ordered by what would block the declaration, which is worth having six weeks before your renewal date rather than six days.
The questions go at configuration rather than policy: whether a firewall covers every device in scope and whether its administrative interface is reachable from the internet, which default credentials and unused administrative accounts still exist, whether device locking is enforced, whether high-risk updates land inside the scheme's 14-day window, and whether multi-factor authentication is on every cloud service without exception. Evidence is whatever shows the real state - Entra ID and Intune compliance views, firewall configuration exports, update-management console output, directory group membership - read with the assessor rather than taken on trust. Anti-malware configuration and application allow listing are scored per device class, because the honest answer is usually different for servers, laptops and bring-your-own devices.
101 controls across 6 pillars and 23 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
A read-only collector reads what Entra ID, Intune and Defender already record about your accounts and devices, and each signal becomes a suggested score an assessor accepts or overrides. Cyber Essentials is unusually machine-checkable on a managed estate, which is why this reaches nineteen question areas rather than a handful; everything it cannot read is established from configuration you display and exports you provide.
It cannot confirm that the devices demonstrated on the day represent every device in scope, which is exactly the gap Cyber Essentials Plus closes with hands-on testing.
Cyber Essentials is a stated condition of many central government and wider public-sector contracts, so readiness here is a bid requirement before it is a security improvement.
Defence primes push the requirement several tiers down their supply chain, so a sub-tier supplier is asked for it on somebody else's timetable.
Health and education buyers ask for it as the baseline before any system touching patient or pupil data is connected to theirs.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is focused at 101 controls.
£2,500
Per engagement, excluding VAT.
£6,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.