No email. No sales call. No jargon.
Where does your security actually stand?
Nine questions, two minutes. You get a straight answer about where you're solid, where you're exposed, and what to do about it — including the fixes you can make yourself this week, free.
Nothing leaves your browser
Your answers aren't sent anywhere or stored on any server.
We only ask what changes the answer
Every question tells you why we're asking it.
Useful even if we never meet
The do-it-yourself fixes are yours to keep.
Guidance, not an audit. Built by Evolfe — IT partners for London businesses without an IT department.
What the check covers
Nine questions, four areas that decide most of it
Small businesses fail on the same handful of things, year after year. Rather than ask you forty questions, the check goes straight at the 9 that change the answer — grouped into the four areas below.
Identity & access
Who can sign in, and what stops someone else
Multi-factor authentication across your cloud services, admin rights that outlived their purpose, shared logins, and what happens to an account when someone leaves. Since April 2026, a cloud service offering MFA that you have not switched on is an automatic Cyber Essentials fail.
Devices
What your team works on
Machines still running an operating system that stopped receiving security updates, disk encryption on laptops that leave the office, and whether personal phones reaching company email are covered by anything at all.
Updates & patching
Whether fixes actually land
High-risk and critical updates carry a 14-day deadline under the standard. Most teams do patch — they simply cannot demonstrate it, which fails an assessment just as surely as not patching.
AI & data boundaries
Where company information ends up
Which AI tools your team already uses, what they paste into them, and whether anyone has drawn a line around client data. This is the newest exposure and the one most firms have no policy for.
Why these questions, now
The rules changed in April 2026
Cyber Essentials moved to version 3.3 on 27 April 2026 — its most significant update in years. Multi-factor authentication became mandatory on every cloud service that offers it. Cloud services can no longer be left out of scope. Passkeys are recognised for the first time.
The practical effect is that a business which would have passed comfortably in 2025 can fail today without having changed anything. The questions in this check are weighted accordingly: the two items that trigger an automatic fail — missing MFA and unpatched critical vulnerabilities — carry the most weight in your result.
We wrote up the full detail of what changed, and what to do about it, in our guide to the April 2026 Cyber Essentials update.
What you get at the end
A straight answer and a list you can act on
A verdict per area
A plain-English read on each of the four areas — Identity, Devices, Updates, Data & AI — and where the priority sits.
The fixes you can make yourself
In priority order, with the steps. Most cost nothing and take an afternoon. This list is yours whether or not you ever contact us.
The parts worth handing over
Honestly separated from the above, so you can see what actually justifies paying someone — and what does not.
A read on certification
Whether Cyber Essentials looks achievable from where you are, and roughly how long it would take.
If what you actually want is for someone to keep all of this in order permanently, that is what our managed IT support is for — monitoring, patching, backups and security handled as a standing arrangement rather than a periodic panic.
Questions about the check
Before you start
No. It is indicative guidance based on nine self-reported answers — useful for finding obvious gaps, not a substitute for an assessment. A real audit inspects your systems directly rather than asking you about them. What this gives you is a straight read on where you stand and a prioritised list of what to do next.
No. There is no form, no gate and no follow-up sequence. Your answers stay in your browser tab — they are not sent to a server or stored anywhere. If you want to keep your results, use the copy button at the end, or note down the check code.
It means you are likely to be in a good position, not that you would certify. The check covers the areas that most commonly cause failures, but a real assessment asks considerably more and requires evidence. A clean result usually means the remaining work is proving what you already do.
Around two minutes. Nine questions, multiple choice, and you can skip any that do not apply. Every question tells you why it is being asked, so you learn something even where your answer is already the right one.
That is the common outcome and it is not a reason for alarm. Most gaps we see are free to close and take an afternoon — the results page separates the fixes you can make yourself this week from the ones genuinely worth handing to a partner. The do-it-yourself list is yours to keep whether or not you ever speak to us.
£950 + VAT for 1–9 people, or £1,450 + VAT for 10–49, with the certificate typically issued in about three weeks and roughly two hours of your time required. We publish our prices rather than asking you to enquire. The 20-minute eligibility check beforehand is free and carries no obligation.