Cyber Essentials Quiz

See where you'd stand under the 2026 rules

The scheme changed on 27 April 2026. The new Danzell question set brings automatic fails for missing MFA and slow patching, and cloud services can no longer be left out of scope. Answer 20 quick questions and see where you'd stand before you spend money on an assessment.

20 questions Under 5 minutes Covers all five controls Nothing leaves your browser
Quick check

A readiness guide, not the assessment

The official self-assessment runs to more than 100 questions, marked by a qualified assessor. This check covers the areas that matter most, so you know what to fix before the real thing.

New for 2026

Flags automatic fails

Three areas can sink an application on their own: MFA on cloud services, 14-day patching of critical updates, and unsupported software or operating systems. This check tells you if you'd trip one.

Practical

Clear next steps

Every gap comes with a fix you can act on, ordered by what matters most. Written the way I'd explain it sat next to you, not the way an assessor would.

Private

No account, no email

Your answers are processed on this page and never sent or stored anywhere. There's no account and no email address - check as many times as you like.

A quick guide, not the official assessment

Your readiness results

0%
Your result

Snapshot based on your 20 answers, checked just now.

Automatic fail risk

Overall readiness

About the real assessment

Official guidance

The official questionnaire is bigger than this one

The verified self-assessment runs to more than 100 questions, though its branching means you won't answer every one. It covers your devices, cloud services, users and processes in detail. Most answers need a written explanation of how the control is implemented across your organisation - not a yes or no. You can download the full Danzell question set free from IASME to prepare your answers in advance.
› Download the official question set

What certification involves

You complete the self-assessment online, a board member signs a declaration that your answers are true, and a qualified assessor marks them. You have six months from purchase to submit, and the certificate lasts 12 months.
Cyber Essentials Plus is the audited level, where an assessor also tests a sample of your devices. It's often required for public sector and supply chain work, and is priced separately.
› Read the NCSC overview

What it costs

Pricing is tiered by organisation size, from £320 + VAT for micro organisations (0 to 9 employees) up to £600 + VAT for large ones. UK organisations with turnover under £20m that certify their whole organisation also get £25,000 of cyber liability insurance included.

By control area

Recommended next steps

A readiness guide based on the NCSC Requirements for IT Infrastructure v3.3 and the Danzell question set, in force from 27 April 2026. It provides general information only, not advice specific to your organisation. Not the official assessment: IASME requires written explanations of how each control is implemented across your organisation, so a strong result here does not mean you would pass. Checked against the Danzell question set, last reviewed July 2026. Bee Support is not affiliated with the NCSC or IASME.