Call

Cyber Essentials

Are you ready for Cyber Essentials?

22 questions on the five controls, each answered yes, no or not sure. You see the result straight away, and you do not need to give a name or an email address.

The questions

They follow the NCSC's Cyber Essentials requirements, version 3.3, which apply to assessment accounts created on or after 27 April 2026. Two are marked as automatic fails: answering no to either fails an assessment on its own.

This is a self-check, not an assessment. The certificate is awarded by an IASME-licensed certification body on the strength of your own self-assessment, and Odyssey is not a certification body. Your answers stay in your browser, and nothing reaches us unless you send us a message below.

Scope

3 questions

Do you have a list of every cloud service the business uses, including the small ones such as accounting, payroll, HR, the CRM, supplier portals and the domain registrar?
What this needs

Every cloud service that holds or processes your data is in scope and cannot be left out. Start with the list.

Do staff read work email or files on their own phones or laptops? (Yes or no, both fine.)
What this needs

If yes: those devices are in scope too, and need the same controls as company devices, apart from phones used only for calls, texts and MFA apps.

Do your IT supplier's or contractors' accounts on your systems follow the same rules as your staff's?
What this needs

Accounts you own are in scope even when a supplier uses them.

Firewalls

5 questions

Is there a firewall between your office network and the internet, either a firewall or a router with its firewall switched on?
What this needs

Every device in scope needs a correctly configured firewall in front of it.

Is the built-in firewall switched on for every laptop, so it is protected at home and on public wifi?
What this needs

Devices used on networks you do not control, such as home broadband or public wifi, need their own software firewall.

Has the default admin password on every router and firewall been changed to a strong, unique one, or remote admin turned off?
What this needs

Default admin passwords on firewalls and routers have to be changed, or remote admin disabled.

Is each router's and firewall's admin page closed to the internet, or protected by MFA or limited to a few trusted addresses?
What this needs

The admin page must not be reachable from the internet unless there is a documented need and MFA or an IP allow list protects it.

Is every rule that lets traffic in from the internet approved, written down with its reason, and removed when no longer needed?
What this needs

Inbound rules need an authorised person's approval, a recorded business need, and removing when they are not needed.

Secure configuration

3 questions

Are unused accounts, such as guest accounts, old staff accounts and spare admin accounts, removed or disabled on computers and devices?
What this needs

Unneeded accounts have to be removed or disabled, and default or guessable passwords changed.

Is software nobody needs removed, and are downloaded files stopped from running automatically without the user's say-so?
What this needs

Unnecessary software and services have to go, and auto-run has to be off.

Does every computer, tablet and phone need a PIN, password or fingerprint to unlock, with a PIN or password of at least six characters, and does it lock or slow down after repeated wrong attempts?
What this needs

Devices need an unlock credential, protection against guessing (no more than 10 attempts), and a minimum of six characters where only a PIN or password unlocks them.

Security updates

4 questions

Is every operating system and application still supported by its maker and receiving security updates? For example, Windows 10 stopped receiving free security updates in October 2025.
What this needs

Unsupported software has to be removed, or the device cut off from the internet in a separate network.

Is all your software properly licensed?
What this needs

Software in scope has to be licensed as well as supported.

Are automatic updates switched on wherever they are available?
What this needs

Automatic updates have to be on where possible.

Automatic failAre critical and high-risk updates installed within 14 days of release on everything: computers, phones, servers, routers, firewalls and applications?
What this needs

Critical and high-risk updates have to be on within 14 days, everywhere. Missing this anywhere is an automatic fail.

User access

5 questions

Does everyone have their own login, with no shared accounts?
What this needs

Users have to sign in with their own unique credentials.

Is there a set way to create and approve new accounts, and are leavers' accounts removed or disabled promptly?
What this needs

You need a process to create and approve accounts, and to remove them when they are no longer needed.

Do people with admin rights use a separate admin account only for admin work, and a normal account for email and the web?
What this needs

Admin accounts are for admin tasks only. Everyday work happens in a standard account.

Automatic failIs multi-factor authentication switched on for every user on every cloud service that offers it?
What this needs

MFA has to be on for every user, not just administrators, on every cloud service that has it. Missing it is an automatic fail.

Where MFA is not used, do passwords have to be at least 12 characters, or at least 8 with common passwords blocked, and is guessing slowed down or locked out?
What this needs

Without MFA, password length and protection against guessing have to be enforced by settings, not left to users.

Malware protection

2 questions

Does every Windows and Mac computer, servers included, have malware protection that is switched on, kept up to date and blocks known malicious websites?
What this needs

Anti-malware has to be active, updated as the vendor recommends, and block malicious code and websites.

Can phones and tablets install apps only from an approved store or list?
What this needs

Devices without anti-malware need application allow-listing: only approved, signed apps can run.

Want help with Cyber Essentials?

Call 01642 661888 and a person answers within three rings, or send us a message. Once you have your result, it goes into the message so we can start from your gaps. Read it, change it or delete it before you send.

We take businesses through Cyber Essentials and Cyber Essentials Plus, from the first gap check to the certificate, and Odyssey is certified to ISO 27001 for information security. More on our Cyber Essentials service. We call back within the hour in office hours.

So we can call you back

Fields marked * are required. We use your details only to reply to this enquiry (see our privacy policy).