Free resource

Cyber Essentials 2026: 10-minute self-check

Tick each statement that is true for your organisation today. Every unticked box is a likely fail point at assessment. Written for organisations running Microsoft 365.

Send it in and we will reply by email, free and in writing, with the gaps that matter most and how to close them.

1. Scope We know how many laptops, desktops, tablets and phones access work email or files, including personal devices. Every device in scope runs an operating system still supported by its vendor (for example Windows 11, a current macOS, iOS or Android). We know which cloud services we use (Microsoft 365, accounting, CRM, file sharing, payroll).

2. Firewalls Our office router's default admin password has been changed, and remote admin is switched off. The built-in firewall is switched on for every laptop and desktop, including home-working devices. No unnecessary ports are open to the internet on our router.

3. Secure configuration Unused software and user accounts are removed from devices. Default passwords on all devices and services have been changed. Devices lock automatically and need a PIN, password or biometric to unlock. Auto-run of downloaded files and USB media is disabled.

4. Security updates Critical and high-risk security updates are installed within 14 days of release, on every device and app. Automatic updates are switched on, or managed centrally (for example through Intune). Software that no longer receives updates has been removed.

5. User access control Multi-factor authentication is on for every user, on every cloud service, not just admins. Staff use standard accounts day to day; admin accounts are separate and used only for admin tasks. Leavers' accounts are disabled on their last day. We have a written list of who has admin rights, and why.

6. Malware protection Every Windows and Mac device has anti-malware switched on and updating (Microsoft Defender counts). Staff cannot install unapproved apps on work phones and tablets, or apps come only from official stores.

Your score

17–19 ticked: you are close. A short review should get you over the line.
10–16 ticked: typical for a small organisation. Most gaps are configuration changes in Microsoft 365, not new purchases.
Under 10: worth fixing before your next tender or insurance renewal.

Get your free gap summary

Your name

Organisation

Work email

Number of users

Anything we should know? (optional)

We use your details only to reply with your gap summary. See our privacy notice.