Cyber Essentials Readiness Assessment
Twenty questions against the five technical controls Cyber Essentials verifies. Instant per-theme results in your browser, a printable gap report, and a clear view of the remediation between you and certification — before you pay an assessment fee.
Quick answer
This free self-assessment checks your readiness against the five Cyber Essentials control themes — firewalls, secure configuration, user access control, malware protection and security update management — with four plain-English questions per theme. Scoring happens in your browser; answers marked "not sure" count as gaps, because the real assessment will make you find out. It is a readiness indicator drafted by AMVIA, not the official IASME question set.
Cyber Essentials Readiness Assessment
Twenty questions across the five technical control themes Cyber Essentials verifies. Answer honestly — "not sure" counts as a gap, because the assessment will make you find out. Nothing you enter here leaves your browser until you choose to request the report.
1.Is every internet connection your business uses protected by a firewall (router firewall or dedicated device)?
2.Have the default administrator passwords on your firewalls and routers been changed?
3.Can the firewall’s admin interface be reached from the internet?
4.Are inbound firewall rules documented, justified and reviewed — with unused ones removed?
5.Are unused software, services and user accounts removed from your computers?
6.Have default passwords been changed on every device (not just firewalls — printers, NAS, Wi-Fi access points)?
7.Does every device require a PIN, password or biometric to unlock?
8.Do you have a current list of the devices and software your business runs?
9.Does every person have their own account — no shared logins?
10.Are admin rights limited to the people who need them, using separate admin accounts (not the account they read email with)?
11.Is multi-factor authentication (MFA) enabled for all users on your cloud services (email, Microsoft 365, etc.)?
12.When someone leaves, are their accounts disabled promptly?
13.Is anti-malware software installed and active on every computer?
14.Does the anti-malware software update itself automatically?
15.Can staff install whatever software they like on work machines?
16.On phones and tablets that access company data, are apps limited to official app stores?
17.Are all your operating systems still supported by their vendor and receiving security updates?
18.Are high and critical security updates applied within 14 days of release?
The 14-day window is a specific Cyber Essentials expectation.
19.Is any software your business depends on past its end-of-life (no longer receiving security fixes)?
20.Are updates set to install automatically where the software supports it?
0/20 answered — results are calculated in your browser.
From gaps to certificate
Find the gaps
Twenty questions, instant per-theme verdicts. Most businesses discover the update-management and access-control themes need the work.
Remediate
Fix what falls short — retire unsupported software, enforce MFA, tighten admin rights, baseline the firewalls. This is the part AMVIA does hands-on.
Certify
With the controls honestly in place, the assessment itself is straightforward — and the annual renewal stops being a scramble.
What the assessment covers
Firewalls
Every connection behind a correctly configured firewall, default credentials gone, admin interfaces off the internet.
Secure configuration
Clean device baselines: no stale software, accounts or default passwords, device unlock enforced.
User access control
Individual accounts, restricted and separated admin rights, MFA on cloud services, leavers disabled promptly.
Malware protection
Anti-malware on every device, updating itself, with control over what users can install.
Security updates
Supported software only, high and critical patches within 14 days — the theme most businesses fail first.
Private by design
Scoring runs in your browser. Nothing is sent to us unless you request the report.
Cyber Essentials resources
Cyber Essentials: the complete guide
What the scheme is, the five controls, and how certification works with an MSP handling remediation.
Cyber Essentials cost
2026 assessment fees by organisation size and the remediation budget most guides skip.
Cyber Essentials certificate checker
Check whether any UK company holds a live certificate on the official register.
All free security tools
The full toolkit: attack surface scan, readiness assessments, certificate checker and more.
Gaps you'd rather not close yourself?
AMVIA prepares UK businesses for Cyber Essentials and Plus — remediation first, then certification. For up to 25 users, the Guaranteed Pass Package covers the lot from £2,995 + VAT, including one re-test if required.
Readiness assessment questions
No. The official assessment is a verified self-assessment questionnaire operated through IASME, and its question set changes over time. This tool is a readiness check drafted by AMVIA against the five control themes — use it to find and fix gaps before you pay an assessment fee.
As accurate as your answers. The scoring is deliberately conservative: any "not sure" counts as a gap, and a theme is only marked ready when every answer in it is. It indicates readiness; it does not guarantee a pass — that judgement belongs to your assessor.
They stay in your browser. Scoring is client-side, and nothing is transmitted to AMVIA unless you choose to request the report, in which case we store only the contact details you enter and your overall result tier.
In our experience preparing UK businesses: unsupported or end-of-life software still in use, MFA not enforced for every user, and admin rights that accumulated over years without review. All three are fixable — the software audit is usually the biggest job.
It depends entirely on the state of the estate — from days for a well-run Microsoft 365-centric business to months where legacy systems need replacing. The assessment's per-theme gaps map directly onto a remediation plan; our cost guide covers how this affects the overall budget.
Yes — certification-with-remediation is exactly what we offer: gap analysis, the remediation work, and support through the assessment, from a provider that holds Cyber Essentials Plus itself.