Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials eligibility checker

A few quick questions to point you the right way.

1. 1.What’s prompting this?

   A contract, client or insurer requires itA UK public-sector or government contractWe just want a solid security baseline

2. 2.Does anyone need independent, hands-on verification (not just a self-assessment)?

   Yes: they want assurance it’s really in placeNo: a verified self-assessment is enoughNot sure

3. 3.Do you use cloud services with remote or hybrid working?

   YesNo / mostly on-premises

4. 4.Is multi-factor authentication enabled on email, cloud services and key systems?

   Cyber Essentials requires MFA on every cloud service that offers it. Passwordless methods such as passkeys count.

   Yes, across the boardNot everywhere yet

5. 5.Are company devices kept patched and protected (updates, anti-malware)?

   Critical and high-risk security updates must be applied within 14 days of release, and software that is out of support removed or segregated.

   Yes, managed and currentInconsistently

6. 6.Are firewalls or boundary protection in place across networks and devices?

   Yes, configured and maintainedNot consistently

7. 7.Are administrator accounts kept separate from everyday user accounts?

   Yes, admin access is separatedNot really