Would you fail Cyber Essentials? Find out in 10 minutes

What the Cyber Essentials auto-fail checker looks at

Every Cyber Essentials assessment opened after 26 April 2026 is marked against the National Cyber Security Centre (NCSC) Requirements for IT Infrastructure v3.3 and IASME’s Danzell question set. While the five core controls — firewalls, secure configuration, security update management, user access control and malware protection — have not changed in name, the way assessments are marked became significantly stricter in April 2026.

Most small businesses fail not because they ignore cyber security, but because one forgotten cloud tool, an unpatched third-party application or an older personal phone trips a mandatory rule. Our 25-question checker tests your setup against those exact pinch points in plain English before you pay the IASME assessment fee.

Why three things now fail an assessment outright

In previous years, minor slips on individual questions could sometimes be weighed alongside your wider controls. Under the April 2026 Danzell marking scheme (IASME), three requirements are designated as automatic failures:

1. Multi-Factor Authentication (MFA) on every cloud service where available: Whenever your staff sign in to an online service that stores or processes organisational data — whether Microsoft 365, Xero, Sage, HubSpot, Dropbox or a sector case-management system — MFA must be enabled for every user. If the software vendor offers MFA as a free feature, a standard option or a paid add-on and you have not turned it on, your assessment automatically fails.
2. 14-day patching for operating systems and router/firewall firmware: High-risk and critical security updates (those rated critical or high risk by the vendor, scoring 7.0 or higher on the Common Vulnerability Scoring System (CVSS) v3 scale, or issued with no severity rating) must be installed within 14 days of release across all computers, servers, phones and boundary routers or firewalls in scope.
3. 14-day patching for applications and extensions: The same 14-day window applies to desktop and mobile applications, web browsers, PDF readers, plugins and browser extensions.

How our scoring works

Each scored question in the checker maps your answer to one of five plain-English statuses, always shown with a text label as well as a colour badge:

• Auto-fail (Red): Directly triggers one of the three April 2026 automatic failure rules (missing cloud MFA, late operating system or firmware patching, or late application patching).
• Likely to fail (Red): Breaches a core v3.3 requirement that assessors routinely fail — such as running Windows 10 without Extended Security Updates (ESU), using Office 2016, 2019 or 2021 past end of support, letting staff work daily in local administrator accounts, leaving default router passwords unchanged, exposing router admin pages to the internet, or lacking anti-malware.
• Needs work (Amber): Highlights practices that put your declaration at risk or fail under closer scrutiny, such as relying on manual patching, sharing cloud logins, leaving leavers’ accounts active, or using an internet-provider router without clear firmware ownership.
• Not sure (Amber): Flags items you need to verify on your systems before you submit, with a one-line tip showing where to look.
• OK (Green): Meets the expected standard based on your answer.

Privacy and independence

Your answers are scored directly in your browser and are never placed into page URLs. You can view your on-screen summary without entering an email address. If you ask us to send your full report, we store your contact details and answers so we can generate your tailored guidance. Five Controls is run by AlphaSec (part of Alphabyte IT Limited) and is completely independent of the NCSC and IASME. Our results are an indication only and not an official certification.

Frequently asked questions