How accurate is the readiness score?

The score reflects your stated answers against the published Cyber Essentials Requirements for Infrastructure. It is not a substitute for the formal assessment, which always involves an external assessor sampling actual devices on assessment day. The quiz is a useful filter for whether to book a scoping call now or work on remediation first.

Is my data stored anywhere?

No. The quiz runs entirely in your browser. Nothing is submitted to NetSec. We have no record of which answers you picked.

What does each readiness tier mean?

Ready (90%+): book the formal CE Plus assessment. Near ready (70-89%): small gap list to close, plan a 1-2 week pre-assessment remediation. Real gap list (50-69%): plan a 4-6 week engagement with structural remediation. Early stage (under 50%): plan structural cyber-controls work before booking the assessment.

What if I don't know the answer to a question?

Pick the 'not sure' option. The output flags 'not sure' answers as gaps to investigate before assessment day. Most CE Plus failures originate in things the firm did not know it needed to check.

Where does the question set come from?

Every question maps to a specific requirement in the published NCSC Cyber Essentials Requirements for Infrastructure. The 14-question coverage spans the five controls (firewalls, secure configuration, user access control, malware protection, patch management) at the depth a typical SME estate needs.

Free CE Self-Assessment

Cyber Essentials Self-Assessment Quiz

14 questions across the five Cyber Essentials controls. Get a CE Plus readiness score plus a per-control breakdown plus specific gaps to investigate.

Runs entirely in your browser. Nothing is submitted or stored.

Cyber Essentials Self-Assessment Quiz

Has the default administrative password on your perimeter firewall been changed?

Is the operating system firewall (Windows Defender Firewall, macOS Firewall, or equivalent) enabled on every in-scope device?

Is multi-factor authentication enabled on every account with access to client data, INCLUDING senior partner / director accounts?

Have unused user accounts (default Windows admin, guest, old service accounts) been removed or disabled?

Has unnecessary software / pre-installed manufacturer apps been removed from in-scope devices?

Does every user have their own individual account (no shared logins for normal operation)?

Are administrative accounts separated from day-to-day user accounts (IT admins use a standard account for email, a privileged account only for admin tasks)?

When staff leave, are their accounts disabled within one working day?

Is malware protection (Windows Defender, third-party AV, or application allow-listing) enabled on every in-scope device?

Are malware definitions / signatures kept up to date (within 24 hours)?

Are operating system patches for high-severity (CVSS 7.0+) vulnerabilities applied within 14 days of vendor release?

Are application-layer patches (browsers, browser plug-ins, productivity software, line-of-business applications) applied to the same 14-day standard?

Do you run any software that is no longer supported by its vendor (end-of-life operating systems or applications)?

Is the firmware on your perimeter firewall (and any other internet-facing network device) on the current vendor release?

Got the readiness score?

Cyber Essentials Self-Assessment Quiz

Has the default administrative password on your perimeter firewall been changed?

Is the operating system firewall (Windows Defender Firewall, macOS Firewall, or equivalent) enabled on every in-scope device?

Is multi-factor authentication enabled on every account with access to client data, INCLUDING senior partner / director accounts?

Have unused user accounts (default Windows admin, guest, old service accounts) been removed or disabled?

Has unnecessary software / pre-installed manufacturer apps been removed from in-scope devices?

Does every user have their own individual account (no shared logins for normal operation)?

Are administrative accounts separated from day-to-day user accounts (IT admins use a standard account for email, a privileged account only for admin tasks)?

When staff leave, are their accounts disabled within one working day?

Is malware protection (Windows Defender, third-party AV, or application allow-listing) enabled on every in-scope device?

Are malware definitions / signatures kept up to date (within 24 hours)?

Are operating system patches for high-severity (CVSS 7.0+) vulnerabilities applied within 14 days of vendor release?

Are application-layer patches (browsers, browser plug-ins, productivity software, line-of-business applications) applied to the same 14-day standard?

Do you run any software that is no longer supported by its vendor (end-of-life operating systems or applications)?

Is the firmware on your perimeter firewall (and any other internet-facing network device) on the current vendor release?

Got the readiness score?