Free Cyber Essentials tools
Most small businesses don’t need another high-level brochure about cyber security — they need to know whether their current laptops, phones and Microsoft 365 settings would pass this year’s rules, what is in scope, and which policies and registers to keep on file.
We built these four free tools around the April 2026 Requirements for IT Infrastructure v3.3 (the Danzell question set). All calculations run in your browser.
1. Auto-fail checker
What it does: Checks 25 practical questions across Multi-Factor Authentication (MFA), 14-day patching, admin accounts, secure configuration and malware protection.
What you get: An instant on-screen breakdown of Auto-fail, Likely to fail, Needs work and OK areas, plus a printable action report with Microsoft 365 setting paths.
Email needed? No email needed for the on-screen summary. Enter your work email if you want the full step-by-step fix report and printable PDF.
2. Scope builder
What it does: Walks through your legal entities, offices, home workers, devices (flagging unsupported operating systems as you pick them), routers, cloud services and exclusions.
What you get: A clean scope summary ready to transfer into your assessment, plus red flags where cloud MFA or unsupported systems would block certification.
Email needed? Optional — everything stays in your browser, with instant copy and print, or you can email a copy to yourself.
3. Evidence pack generator
What it does: Tailors six plain-English security policies and three registers (devices & software, admin accounts, and cloud services with MFA status) to your business.
What you get: Downloadable, editable policy templates and register files to back up your director’s annual compliance declaration and satisfy client questionnaires.
Email needed? Yes — enter your work email to unlock and download the tailored pack.
4. Renewal reminder
What it does: Tracks your 12-month Cyber Essentials or Cyber Essentials Plus expiry date so your certificate never lapses mid-contract.
What you get: Email reminders 90, 60 and 30 days before expiry, including a plain-English summary of what changed in the scheme since you last certified.
Email needed? Yes — your work email is where we send the 90, 60 and 30-day reminders.
Important note: Our tools give an indication only based on the answers you select. They are not an official Cyber Essentials assessment or certification, and Five Controls is independent of the NCSC and IASME.