Microsoft 365 Security Baseline for SMEs
The settings that quietly decide whether a stolen password becomes a break-in.
Read the guide ->A quick, plain-English self-check — written for business owners and IT managers, not security specialists. Answer a handful of questions and get an honest read on whether you’d sail through Cyber Essentials or have some tidying up to do first. No sign-up, and nothing leaves your browser.
Cyber Essentials is the UK’s government-backed security baseline. It checks five practical areas: firewalls, secure configuration, security updates, who can access what (and MFA), and malware protection. This tool turns those into plain questions so you can gauge where you stand. It’s an informal indicator, not the official assessment — but it lines up with what you’d actually be asked.
If the check flagged a few things, these go deeper on the areas businesses most often trip over.
The settings that quietly decide whether a stolen password becomes a break-in.
Read the guide ->What the certificate does and doesn’t prove — and where to go next.
Read the guide ->How we bring new clients up to a certifiable baseline, with no upfront project fee.
See onboarding ->No. This is an informal, plain-English indicator. The official certification is the IASME self-assessment questionnaire, submitted through a licensed certification body and verified before a certificate is issued. This check mirrors the same control areas, so you get an honest read on where you stand before you apply.
Five practical areas: firewalls and internet connections, secure device configuration, security update management, user access control and multi-factor authentication, and malware protection. It is deliberately about the basics that stop the most common attacks — not a deep technical audit.
No. The questions are written for business owners and IT managers rather than security specialists, and the helper text explains what to look for in plain terms. If you are not certain of an answer, mark it “not sure” and treat it as something to confirm.
No. Your answers stay in your browser and nothing is sent anywhere — unless you choose to enter your email at the end to have your result and a checklist sent to you. We only send marketing emails if you tick the optional box.
That is completely normal, especially the first time. The gaps it lists are the things worth tidying before you apply. You can work through them yourself, or book a free health check and we will give you a clear, prioritised route to a clean pass.
If the check turned up gaps, that’s normal — and exactly what we fix. Book a free health check and we’ll give you a clear, prioritised route to a clean Cyber Essentials pass.