In short: A Cyber Essentials gap analysis is a readiness review that compares your actual IT against the five technical controls in the NCSC's Requirements v3.3 and the Danzell question set. It inventories devices, checks software support and patch status, MFA coverage, firewalls, admin accounts and malware protection, and produces a prioritised remediation plan.
Why a gap analysis before you apply
Under Danzell, the "point in time" a certificate reflects is the date it is issued, so your systems must meet the requirements on that day, and the Danzell question set is less forgiving than earlier versions. A cloud service without MFA, a laptop with a critical update outstanding for more than 14 days, or one unsupported operating system can each fail the whole assessment on its own.
If you fail, IASME gives you two working days to amend your answers free of charge. Two days is enough to correct an unclear answer, but rarely enough to replace hardware, roll out MFA or fix patching across a fleet. After that you reapply and pay again. A gap analysis moves that discovery to the start, when you have time to plan and budget.
A self-check is a good first step. IASME's free Cyber Essentials Readiness Tool and our own Cyber Essentials checklist will show you the questions. What they cannot do is look at your devices and cloud tenants to confirm the answers, which is what a gap analysis adds.
What we review
We look at every area the assessment covers, using your management consoles and tooling rather than relying on memory.
| Area | What we look at | Typical findings |
|---|---|---|
| Scope and legal entities | Which entities, sites, networks and services should be in scope; whether a sub-set is properly segregated | Cloud services left out, no end-user devices in a sub-set, entities missing |
| Asset inventory | Laptops, desktops, servers, phones, tablets, virtual machines, network devices and IaaS | Devices nobody knew about, unmanaged personal devices |
| Software support status | Operating system and application versions against vendor end-of-support dates | Windows 10 without ESU, old server versions, unsupported apps |
| Patching | Whether critical and high-risk fixes, including firmware, land within 14 days | Third-party apps and router firmware behind |
| Cloud tenants and MFA | Every cloud service, every user and admin, and how MFA is enforced | Admin or legacy accounts without MFA, a SaaS app without it switched on |
| Firewalls and routers | Admin passwords, exposed admin interfaces, inbound rules and their documentation | Default passwords, remote admin open to the internet, undocumented port forwards |
| Accounts and privileges | Joiner and leaver process, shared accounts, separate admin accounts, MSP access | Everyday use of admin accounts, leavers still active |
| Secure configuration | Unneeded software and accounts, auto-run, device locking and brute-force protection | Guest accounts enabled, weak unlock settings |
| Malware protection | Which mechanism each device uses and whether it is active and updated | Gaps on servers or Macs, protection disabled |
| BYOD and home working | Personal devices reaching work data, home routers, VPN use | Personal phones with work email but no management |
How the gap analysis works
- Scoping conversation. We agree which parts of the organisation you want to certify, which level, and any deadline such as a tender or contract renewal.
- Discovery. With your permission we review device management, cloud admin centres, firewall and router configuration, endpoint protection consoles and account lists, and run an external scan of your internet-facing addresses.
- Assessment against Danzell. We map what we find to each requirement and question, flagging automatic fails separately from other gaps.
- Report and plan. You get a written summary, a prioritised remediation plan, and a recommended scope.
- Remediation (optional). We can fix the gaps for you, or support your own IT team while they do.
- Final check. Before you submit, we confirm the fixes are in place so your answers describe what is true today.
What you get
- A clear verdict for each of the five controls: ready, nearly ready, or not ready
- A list of automatic-fail risks, so they are fixed first
- A prioritised remediation plan with practical options, for example upgrading, replacing or isolating unsupported devices
- A recommended scope and a list of the legal entities to declare
- An honest view of whether Cyber Essentials Plus is realistic now, or should follow later
- Notes you can keep for next year's renewal
Remediation costs, such as replacing hardware or adding licences for MFA, endpoint protection or device management, can outweigh the assessment fee itself. Knowing them early helps you budget; see Cyber Essentials cost for the factors.
Gap analysis for Cyber Essentials Plus
If you are aiming for Plus, the gap analysis becomes a rehearsal of the audit. Under Danzell your self-assessment must be final before Plus testing starts, and if a sampled device fails the patching test the retest adds a new random sample; a second failure revokes your self-assessment certificate too. That makes it worth testing first.
We run the same kinds of checks the assessor will: an external vulnerability scan, authenticated patch scans of representative devices, email and browser malware test files, MFA sign-in checks on each cloud service and an admin-rights test. The Cyber Essentials Plus audit page describes the real thing step by step.
Who we are and how to start
Forever Systems Ltd is an IT and cyber security provider. We prepare organisations for certification and work alongside an IASME-licensed Certification Body; we are not a Certification Body and do not issue certificates. That separation keeps the assessment independent.
The gap analysis suits organisations applying for the first time, those whose renewal is approaching after a year of change, and anyone who has failed before and wants to understand why. Pricing depends on the size and complexity of your IT, so ask us for a quote. Contact us to book a gap analysis.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is a Cyber Essentials gap analysis?
It is a review of your actual devices, cloud services, network and accounts against the five Cyber Essentials controls and the current question set. It identifies what would fail, flags automatic-fail risks and gives you a prioritised plan to fix them before you apply.
Is there a free Cyber Essentials readiness check?
Yes. IASME offers a free Cyber Essentials Readiness Tool and a free download of the question set booklet, and our checklist covers the common gaps. These are self-checks; a gap analysis adds hands-on review of what is really configured.
How long does a Cyber Essentials gap analysis take?
It depends on the number of devices, sites and cloud services in scope and how easily we can reach your management tools. Small organisations with central device management are quickest. We agree a timetable during the scoping conversation.
Do we need a gap analysis if we already have Cyber Essentials?
Not necessarily, but a lot changes in a year: new devices, new cloud apps and staff changes. A review before renewal is especially useful if you certified under an older question set, because Danzell added automatic fails for cloud MFA and 14-day updates.
Can a gap analysis make sure we pass?
No one can promise a result, because the Certification Body's assessor makes the decision. A gap analysis removes the known causes of failure and makes sure your answers match reality, which is the best preparation available.