Free assessment

Find out whether you would pass, before you apply

The five control themes, checked against what you actually run. Most first-time failures are the same handful of things, and all of them are cheaper to fix before you apply.

Free45 minutes, plus a written gap list within three working days

Who books this

  • A contract, tender or insurer requires Cyber Essentials and you have a date
  • You are not sure whether you need Cyber Essentials or Cyber Essentials Plus
  • You have applied before and failed, or withdrew partway
  • You have unsupported software in scope and do not know if it is fatal

What you get

  • A gap list against all five control themes, with what would fail today
  • A straight answer on whether you need Plus, and what that adds
  • Guidance on scoping, including whether unsupported machines can be segregated out
  • A realistic timeline, so you know if the deadline is achievable before committing

What we need from you

  • A rough device and operating system inventory, however informal
  • Who administers your cloud services, and whether they use separate accounts
  • Any deadline you are working to, because it changes the order of the work
When not to book this

If you hold current certification and are simply renewing with no estate changes, you do not need this. Renew directly and spend the time on something that matters.

One we have done

Certified Cyber Essentials

How a client closed its security gaps and achieved Cyber Essentials certification, meeting the assurance its contracts and supply chain demanded.

Read what we actually did

A UK client. Our case studies are anonymised at our clients’ request, so they name no client and no sector.

Other assessments

  • Microsoft estate review: Forty-five minutes and a written summary. What you are licensed for, what is switched on, where the gaps are, and what we would fix first.
  • Security posture review: Most of what we find is not missing products. It is features you already pay for that were never switched on. Forty-five minutes to find out which.
  • Cloud cost review: Non-production running around the clock, orphaned resources nobody decommissioned, and licences still assigned to leavers. Forty-five minutes to quantify yours.
  • Application compatibility assessment: Migrations do not stall on operating systems, they stall on a handful of applications nobody can account for. This sorts your estate into the four groups that actually matter, before you commit budget to any of it.
  • Virtual desktop review: Whether you are choosing between Azure Virtual Desktop and Windows 365 or already running one and paying more than you expected, this is the same review: what the estate is doing, what it costs, and what it should cost.
  • Copilot readiness check: Copilot does not grant anyone a single permission they did not already have. It just makes what they already had very easy to find, which is why the permissions work belongs before the licences and not after.
  • Backup and recovery review: Everyone has a backup. Far fewer have a restore. The question worth answering is not whether jobs are running, it is when somebody last proved one and how long the business would be down.
  • Application and reporting discovery: Most bespoke software goes wrong at scoping rather than in the build, and the most valuable thing a first conversation can do is establish whether you should be commissioning software at all.
  • Endpoint and Intune review: Not whether Intune says the estate is compliant, but whether that means what you think it means: what is enrolled, what has gone quiet, which policies are actually winning, and what you could prove if somebody asked.