--- title: Cyber Essentials Readiness Assessment | Datatechs Consulting description: Gap analysis against the Cyber Essentials technical controls before you submit. Know what will fail while you can still fix it. image: https://www.datatechs.co.uk/hubfs/raw_assets/public/datatechs-theme/images/Datatech_OG.png --- [Skip to content](https://www.datatechs.co.uk/audit/cyber-essentials#main-content) [![Datatechs home](https://www.datatechs.co.uk/hs-fs/hubfs/Datatech%20Consulting%20Limited.png?width=2130&height=676&name=Datatech%20Consulting%20Limited.png "Datatechs home")](https://www.datatechs.co.uk?hsLang=en-gb) [![](https://www.datatechs.co.uk/hubfs/Datatech%20Consulting%20Limited%20-%20INVERT.png)](https://www.datatechs.co.uk/?hsLang=en-gb) [Home](https://www.datatechs.co.uk/?hsLang=en-gb) [Services](https://www.datatechs.co.uk/services?hsLang=en-gb) [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [Professional Services and Consultancy](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) [View all services →](https://www.datatechs.co.uk/services?hsLang=en-gb) [Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [CIS M365 Benchmark](https://www.datatechs.co.uk/audit/cis-m365?hsLang=en-gb) [CIS Intune Benchmark](https://www.datatechs.co.uk/audit/cis-intune?hsLang=en-gb) [Cyber Essentials](https://www.datatechs.co.uk/audit/cyber-essentials?hsLang=en-gb) [View the full audit →](https://www.datatechs.co.uk/audit?hsLang=en-gb) [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) Resources Free Downloads [M365 Security Essentials Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) [Intune Security Essentials Checklist](https://www.datatechs.co.uk/resources/intune-security-essentials?hsLang=en-gb) [About](https://www.datatechs.co.uk/about?hsLang=en-gb) [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) [Contact Us](https://www.datatechs.co.uk/contact?hsLang=en-gb) [Home](https://www.datatechs.co.uk/?hsLang=en-gb) [Services](https://www.datatechs.co.uk/services?hsLang=en-gb) [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [Professional Services and Consultancy](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) [Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [CIS M365 Benchmark](https://www.datatechs.co.uk/audit/cis-m365?hsLang=en-gb) [CIS Intune Benchmark](https://www.datatechs.co.uk/audit/cis-intune?hsLang=en-gb) [Cyber Essentials](https://www.datatechs.co.uk/audit/cyber-essentials?hsLang=en-gb) [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) Resources [M365 Security Essentials Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) [Intune Security Essentials Checklist](https://www.datatechs.co.uk/resources/intune-security-essentials?hsLang=en-gb) [About](https://www.datatechs.co.uk/about?hsLang=en-gb) [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) [Contact Us](https://www.datatechs.co.uk/contact?hsLang=en-gb) Cyber Essentials # Find out what will fail your Cyber Essentials assessment while you can still fix it. Cyber Essentials is pass or fail, and since April 2026 more of it fails automatically. We assess your environment against the current technical requirements before you submit, so nothing in the questionnaire is a surprise. [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [Request a quote →](https://www.datatechs.co.uk/contact?hsLang=en-gb) Not ready to talk yet? [Start with the free checklist.](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) Five technical control areas Danzell question set CE and CE Plus Independent readiness check What it is ## Government-backed, IASME-delivered, pass or fail. Cyber Essentials is the UK government-backed certification scheme for baseline cyber security. It is overseen by the National Cyber Security Centre and delivered by IASME as the NCSC’s official delivery partner. It sets out five technical control areas that an organisation must have in place. **What changed in April 2026.** The current question set, Danzell, took effect on 26 April 2026 and made the scheme materially stricter. Multi-factor authentication is now mandatory for all cloud services where it is available, and its absence is an automatic fail. High-risk and critical security updates must be installed within 14 days, and two new questions make this an automatic fail as well. There were also changes to how scope is defined and documented, and to Cyber Essentials Plus retesting. If your last certification predates April 2026, the bar you passed is not the bar you face next time. Overseen by National Cyber Security Centre (NCSC) Delivered by IASME, as the NCSC’s official delivery partner Current question set Danzell, in effect since 26 April 2026 Routes Cyber Essentials, and Cyber Essentials Plus Why it matters ## Increasingly a condition of bidding, not a nice to have. It is increasingly not optional Cyber Essentials is required for many UK government contracts and is now a routine condition in enterprise and public sector supplier agreements. Organisations are being asked for it as a qualifying condition to bid. Failing is expensive in time, not just money A failed self-assessment means remediation under time pressure, often with a contract deadline attached. The insurance is real UK organisations with turnover under £20 million that certify get cyber liability insurance included, with incident response support. For a smaller organisation that is a genuine commercial return on the certification. It is a floor, not a ceiling Cyber Essentials covers the most common attacks. It is a sensible baseline rather than a comprehensive security programme, and we will tell you where it leaves gaps rather than implying it solves everything. The five controls ## Five technical control areas. - 1 Firewalls Boundary and software firewalls configured to control what reaches your network from the internet and between internal networks. - 2 Secure configuration Devices and software set up deliberately: unnecessary software removed, default credentials changed, security settings applied rather than assumed. - 3 User access control Accounts holding only the access the role requires, administrative accounts minimised and separated, and strong authentication in place. This is where the new MFA requirement bites. - 4 Malware protection Anti-malware deployed, current and actually running, or application allowlisting where that fits better. - 5 Security update management Software supported and patched, with high-risk and critical updates installed inside 14 days. This is where the second new automatic fail sits. The two routes ## Cyber Essentials, and Cyber Essentials Plus. There are two routes, and one is a prerequisite for the other. Route one Cyber Essentials A self-assessment questionnaire, independently verified by an assessor. Route two Cyber Essentials Plus Covers the same five controls but adds a hands-on technical audit. - External vulnerability scanning - Testing of a representative sample of devices - Cyber Essentials is a prerequisite - The Plus audit must follow within three months of the Cyber Essentials certification How we help ## We prepare you. We do not certify you. 01 Scoping A short call to understand your environment and what is driving the certification, usually a contract requirement with a date attached. Scope and fee confirmed up front. 02 Gap analysis We assess your environment against each of the five control areas and against the current question set, including the April 2026 automatic-fail conditions. 03 Report and remediation plan What passes, what fails, and what to do about each gap, in the order that matters. 04 Remediation Where you want it, we carry out the fixes, most often around MFA coverage, patch enforcement and administrative account separation. What you receive - A gap analysis against each of the five technical control areas - An assessment against the current Danzell question set, including the April 2026 automatic-fail conditions - What passes, what fails, and what to do about each gap, in the order that matters - An introduction to a Certification Body we trust, when you are ready to certify Scope and fee ## Quoted per engagement. Certification fees are IASME’s. Quoted Scope and fee confirmed at the discovery call, before any work begins. We are not a Certification Body. We do not issue Cyber Essentials certificates and we will not pretend otherwise. What we do is the readiness work, so you know exactly what would fail before an assessor sees it. How the two fees work - Our readiness work is scoped and quoted separately - Certification fees are set by IASME and vary by organisation size - Those fees are paid to the Certification Body, not to us - When you are ready to certify, we introduce you to a Certification Body we trust and work alongside them through submission [Request a quote](https://www.datatechs.co.uk/contact?hsLang=en-gb) Official sources ## Read it from the source. The scheme is run by the NCSC and IASME, not by us. Read it there, and check any certificate you are shown. [NCSC Cyber Essentials overviewncsc.gov.uk](https://www.ncsc.gov.uk/cyberessentials/overview)[IASME Cyber Essentialsiasme.co.uk](https://iasme.co.uk/cyber-essentials/)[NCSC certificate searchiasme.co.uk](https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/) Framework information checked on 18 September 2026. FAQ ## Common questions Can you certify us directly? No. We are not a Certification Body. We prepare you, and we introduce you to a certification partner we work with regularly. We certified last year. Does anything change? Yes, if your certification predates 26 April 2026. The Danzell question set added automatic fails for missing MFA on cloud services and for critical updates not installed within 14 days. Renewals are assessed against the current requirements. Should we go straight to Cyber Essentials Plus? You cannot. Cyber Essentials is a prerequisite, and the Plus audit has to follow within three months of it. If Plus is the goal, that timing is worth planning around from the start. How much does certification cost? Certification fees are set by IASME and vary by organisation size, paid to the Certification Body rather than to us. Our readiness work is scoped and quoted separately. We are a Microsoft 365 shop. Does the CIS assessment cover this? They overlap but they are not the same. Cyber Essentials is a broader baseline covering firewalls and devices as well as cloud, and it is pass or fail. The CIS Benchmark goes far deeper on Microsoft 365 specifically. Organisations often do both, usually in that order. ## Know what will fail before an assessor tells you. A short discovery call is enough to scope the gap analysis and give you a fixed fee. [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [View services](https://www.datatechs.co.uk/services?hsLang=en-gb) [![Datatechs](https://www.datatechs.co.uk/hs-fs/hubfs/Datatech%20Consulting%20Limited%20-%20INVERT.png?height=56&name=Datatech%20Consulting%20Limited%20-%20INVERT.png)](https://www.datatechs.co.uk/?hsLang=en-gb) Microsoft 365 security and compliance for organisations and MSPs. Services - [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) - [Professional Services](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) - [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) - [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) - [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) - [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) Resources - [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) - [M365 Security Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) Company - [About](https://www.datatechs.co.uk/about?hsLang=en-gb) - [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) - [Contact](https://www.datatechs.co.uk/contact?hsLang=en-gb) - [Book a call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) Contact - [hello@datatechs.co.uk](mailto:hello@datatechs.co.uk) - United Kingdom © 2026 Datatechs Consulting Limited. Registered in England and Wales, company number 16868376. Registered office: Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, BL6 6HG. [Privacy Policy](https://www.datatechs.co.uk/privacy-policy?hsLang=en-gb) [Terms](https://www.datatechs.co.uk/terms?hsLang=en-gb)