Browse tools

Cyber Essentials Checker

Work through every Cyber Essentials question in plain English before you pay for an assessment. We flag answers that would fail, including the automatic fails added in 2026, and keep your notes and evidence in a log book you can save, share with your IT provider and print.

Start a Cyber Essentials log book

About 110 questions across your organisation, scope, firewalls, secure configuration, updates, user access and malware protection, plus recommended extras. Most people finish in an hour or two, and you can stop and come back.

Your answers are saved automatically in this browser and never leave it unless you choose to save online.

Open a log book

Files saved from this tool, or from the earlier version of our Cyber Essentials log book, can be imported.

What changed in April 2026

  • New question set: "Danzell" replaced "Willow" for assessment accounts created from 27 April 2026, alongside the Requirements for IT Infrastructure v3.3.
  • Automatic fails: answering "no" to A6.4 or A6.5 (critical updates within 14 days) or to cloud MFA for admins and users (A7.16, A7.17) fails the whole assessment.
  • MFA wherever it exists: if a cloud service offers MFA in any form, even as a paid extra, it must be on for everyone.
  • Cloud services always in scope, every legal entity listed, and excluded networks described and justified.
  • "Web applications" became "application development", referring to the UK Software Security Code of Practice.

How to use it

  • Answer honestly for every device and account: the answer must be true all the time, not just on the day.
  • Use the notes to record how you know: who checked, when, and what evidence you'd show.
  • Read the readiness report and fix anything marked "would fail" before submitting through the IASME portal.
  • Need the audited version? Use the Cyber Essentials Plus Readiness tool.
Is this the official question set?

The questions follow IASME's Danzell question set numbering, written in our own plain-English words with our own guidance. You still answer the official questions in the IASME portal when you apply through a certification body; this tool helps you get the answers right first.

Where are my answers stored?

In your browser, automatically. If you choose "Save online", an encrypted copy is stored on our server under a private access code. We keep only a scrambled fingerprint of the code, so we can't read your log book, and online copies are deleted after 24 months without changes.

Can I import a log book from the old version?

Yes. Files from our earlier Willow-based log book are converted, with renumbered questions moved to their new Danzell numbers. Check the imported answers, because several questions changed in 2026.

How much does certification cost?

IASME sets a fixed fee by organisation size, from micro businesses upwards: check its current price list. Cyber Essentials Plus costs more and is priced by each certification body, because an assessor tests your systems.

More free tools