Ready for Cyber Essentials before the assessor arrives.
If you supply companies or public bodies in the United Kingdom, you are increasingly asked for Cyber Essentials. veyrisk shows you in advance how your systems look from outside and maps every finding to one of the five controls.
What Cyber Essentials requires
Cyber Essentials is a certification scheme of the UK National Cyber Security Centre (NCSC). It assesses five technical controls. Certification runs through IASME and its licensed certification bodies and is valid for twelve months. With Cyber Essentials Plus, the certification body also tests the controls technically.
- Firewalls: filter traffic between the internet and your own network
- Secure configuration: set up devices and software to leave as little attack surface as possible
- Security update management: close vulnerabilities, critical and high-risk ones within 14 days
- User access control: limit accounts and rights, multi-factor authentication for cloud services
- Malware protection
What changed in April 2026
- Cloud services are always in scope and cannot be excluded.
- Every device with an internet connection counts, whichever direction the connection is made in.
- If a cloud service offers multi-factor authentication and it is not enabled, the assessment fails.
- Passkeys count as passwordless sign-in.
What veyrisk can check from outside
| Control | Checkable from outside | What veyrisk contributes |
|---|---|---|
| Firewalls | yes | Open ports, reachable admin interfaces and services that do not belong on the internet |
| Secure configuration | partly | Encryption, security headers, default pages and misconfigurations |
| Security update management | yes | Outdated software and known vulnerabilities. High and critical issues older than 14 days are highlighted |
| User access control | partly | Multi-factor authentication and admin rights in Microsoft 365 and cloud, if connected |
| Malware protection | no | Must be evidenced internally |
The Cyber Essentials report
For each control the report shows the status, the open findings and what you still need to evidence internally, such as the device list and malware protection. It is a readiness check from outside, not a certification. veyrisk does not issue certificates. The report is included in Business and Professional and can be added to Start and Basis.
Preparing for the technical assessment
With Cyber Essentials Plus, the certification body tests your systems itself. Anything veyrisk finds beforehand and you fix will no longer show up there. You can also request a manual penetration test by the specialists of neonotu GmbH.
Frequently asked questions
Does veyrisk issue the certificate?
No. Certification is done only through IASME and its licensed certification bodies. veyrisk helps you prepare for it.
Is the veyrisk report enough for certification?
No. For Cyber Essentials you complete a self-assessment that the certification body marks. The report shows you beforehand where gaps remain from outside and gives you evidence for your answers.
How often should we check?
The certificate is valid for twelve months. veyrisk checks continuously, so you also see between two certifications whether new gaps have appeared.
What is veyrisk?
Platform, process and limits in brief
Learn moreWhat is checked?
All checks of the five services at a glance
Learn moreISO 27001 and NIS2
Why vulnerability scans and pentests are required
Learn moreSample report
What reports and the console look like
Learn moreUse cases
Who veyrisk is for
Learn moreWhat does your attack surface look like?
We scan your external attack surface for free and walk you through the results in 30 minutes.