Question 1

What is Cyber Essentials?

Accepted Answer

Cyber Essentials is a UK Government-backed certification scheme, administered by IASME on behalf of NCSC, that tests an organisation's controls across five themes: firewalls, secure configuration, security update management, user access control, and malware protection. It is the baseline certification required on many government and public sector contracts.

Question 2

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Accepted Answer

Cyber Essentials is a verified self-assessment: you answer questions about your controls and an assessor reviews your answers. Cyber Essentials Plus adds hands-on technical testing by an independent auditor who verifies that the controls you described actually work on your real systems. CE+ is the same five themes, independently tested.

Question 3

Why do roughly half of organisations fail their first attempt?

Accepted Answer

The scheme is binary: one non-compliant device, account or cloud service in your declared scope fails the control for the whole organisation. Most first-time applicants underestimate their scope, have exceptions they consider minor, or have devices such as a director's personal laptop quietly excluded from their answers. The assessor's job is to find the exception.

Question 4

Is a PASS on this tool the same as the real certificate?

Accepted Answer

No. This is a readiness signal, not a certificate. Cyber Essentials certification comes only through an IASME-licensed certification body. A PASS prediction here means your self-assessed answers are consistent with passing, which is worth knowing before you pay for the real assessment.

Question 5

What do you get?

Accepted Answer

You answer across the five control themes and receive a pass or fail prediction at theme level, the exact findings an assessor would write up for every non-pass answer, and a prioritised remediation list.

Question 6

Do I need technical knowledge to use this?

Accepted Answer

Some basic familiarity with your IT setup is helpful. You need to know whether your devices are patched, whether MFA is on, and whether antivirus is running. If you cannot answer those questions, that is itself a finding worth knowing before you apply.

Half of companies fail their first Cyber Essentials attempt. Would you pass today?