Gap analysis
A gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it. It is optional and not part of the scheme. A good one follows the Danzell questions, checks the automatic fails first, and gives a prioritised fix list. It does not issue a certificate.
- Term
- Gap analysis
- Also known as
- readiness review, pre-assessment, Cyber Essentials gap analysis
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term gap analysis mean in Cyber Essentials?
A gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
How does gap analysis apply to Cyber Essentials?
In plain terms
It is a mock exam. Someone who knows the marking scheme reads your draft answers, tells you which would fail and why, and gives you time to fix them before the real thing.
How it relates to Cyber Essentials
The scheme does not require one. The NCSC requirements tell applicants to establish their scope, "Review each of the five technical control themes" and "Take the necessary steps to ensure that your organisation meets every requirement it needs for the scope you have determined". A gap analysis does that in a structured way. The most valuable checks are the ones that cannot be argued at marking: the 14-day update rule at A6.4 and A6.5, MFA for cloud administrators and users at A7.16 and A7.17, and the list of cloud services without MFA at A7.15. Supported software (A6.1 to A6.3) comes next, because replacing hardware takes weeks.
What a good one covers
Every in-scope device and cloud service, not a sample. The evidence behind each Yes. A fix list ordered by what would fail first. If you want to start on your own, the NCSC's free readiness tool and this site's checker give a quick first view.
Precursor Security, which runs this site, offers a gap analysis from £500 + VAT, typically taking 1 to 3 days.
See Cyber Essentials gap analysis, the free readiness checker and remediation.
Related terms
- Cyber Essentials Readiness ToolThe Cyber Essentials Readiness Tool is a free online questionnaire from the NCSC, run with IASME, that asks about your IT and gives a personalised action plan for meeting Cyber Essentials.
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- IASME Cyber AssuranceIASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
- ISO 27001ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
Frequently asked questions
A gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
In the 2026 Danzell question set, gap analysis comes up at A6.4, A6.5, A7.15, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.