Cyber Essentials gap analysis: what the self-assessment misses by design
Geert WarmenbolApril 29, 2026
Key takeaways
Cyber Essentials self-assessment verifies that controls are documented and described. It does not verify that they operate as described — a WAF in log-only mode passes the self-assessment question about web application protection while blocking nothing.
The most consistent Cyber Essentials gap found in manufacturing and OT-adjacent environments is default credentials on PLCs and HMIs that are technically in scope for Requirement 5 but excluded from the self-assessment because auditors rely on documentation rather than device-level verification.
Boundary firewall compliance under Requirement 1 is assessed against inbound rules. Egress filtering — blocking internal systems from communicating with attacker-controlled infrastructure — is not explicitly required by the scheme, and most organizations that pass Requirement 1 have no egress controls beyond default allow-all.
Cyber Essentials Plus is the version where the technical controls actually get tested. Organizations that certify at the standard level and assume the Plus assessment would produce the same result are consistently wrong — the gap between self-assessed and externally verified compliance is where the scheme's structural limitation lives.
Shadow IT creates Cyber Essentials scope problems that self-assessment cannot detect. An unmanaged device running on a network in scope, or a cloud service processing data outside the declared boundary, fails the scheme's requirements regardless of whether it appears in the self-assessment answers.
TL;DR
Cyber Essentials is a self-assessment scheme. Its structural limitation is that it verifies what organizations say about their controls, not what those controls actually do. A gap analysis that starts from the attack surface rather than the questionnaire consistently finds the same categories of failure: protection controls configured in non-blocking modes, default credentials on devices outside the documentation review scope, egress blind spots that pass inbound-only firewall assessment, and cloud and contractor assets that are in scope by the scheme's definition but out of scope by the organization's self-assessment. This article covers what those gaps look like and how to find them before a Plus assessment does.
The WAF that logged everything and blocked nothing
An e-commerce company renewed its Cyber Essentials certification for the third consecutive year. Their self-assessment answers for Requirement 4 — malware protection — described a web application firewall protecting their customer-facing application. The answer was accurate. The WAF existed. It had been configured during a migration project two years earlier and had remained in the configuration that the implementation team left it in: detection mode, sometimes called simulation or log-only mode, depending on the vendor.
Detection mode means the WAF logs what it would block if enforcement were enabled. It does not block anything. Every SQL injection attempt, every automated scan, every credential stuffing request that hit the application over two years was logged and allowed through. The self-assessment question asked whether malware protection was in place. The answer was yes. The self-assessment had no mechanism to ask whether the protection was enforced. The gap between the documented control and the operating control was invisible to the certification process and visible to anyone running an active test against the application.
Why Cyber Essentials self-assessment produces systematically optimistic results
Cyber Essentials is designed to be accessible to organizations without dedicated security teams. That design choice — a self-assessment questionnaire answered by internal staff — creates a structural pattern in the results. The questionnaire asks whether controls exist and whether they are configured as required. It cannot ask whether they operate as configured, because verifying operation requires external testing that the self-assessment format does not include.
This produces a specific class of gap: controls that exist, are correctly described in the self-assessment, and do not work. The WAF in log-only mode is the clearest example, but the pattern appears across every requirement category. A firewall rule that exists in configuration but is overridden by a subsequent allow-all rule passes a documentation review. A patch management process that runs on a defined schedule but excludes devices added after the process was established passes a policy review. An MFA requirement that applies to all user accounts except the service accounts used for system integrations passes a user account review.
Cyber Essentials Plus addresses this directly. The Plus assessment involves external technical verification: vulnerability scanning, configuration review, and in some cases penetration testing. Organizations that have passed the self-assessment and then attempted Plus certification discover the gap between self-assessed and externally verified compliance. The gap is not a failure of honesty in the self-assessment — it is a failure of visibility. Internal staff describing internal controls will describe them as they are understood to operate, not as they actually operate.
A gap analysis that replicates the Plus methodology without the formal assessment produces the same findings earlier and at lower cost than discovering them during a failed Plus attempt.
Example
A logistics company in the UK completed Cyber Essentials self-assessment with passing answers across all five control categories. When preparing for Cyber Essentials Plus, an external configuration review found that their boundary firewall's inbound rules were correctly configured, but an administrative account used for remote management of the firewall itself had not had its default password changed. The account was not in scope for the self-assessment's user account review because it was a device management account, not a user account in the directory. The firewall passed. The firewall's management interface was accessible with vendor default credentials. These are not the same thing, and the self-assessment format does not create a mechanism for distinguishing between them.
The Cyber Essentials scope boundary is defined by the organization in the self-assessment. Devices and services within the boundary are assessed. Devices and services outside the boundary are not. The scheme requires that the boundary be defined to include all devices used for work purposes, but the verification of boundary completeness is done by the organization rather than an external assessor. Shadow IT — devices and services in operational use that are not in the declared boundary — fails the scheme's requirements by definition but is invisible to the self-assessment process. External asset discovery before self-assessment is the only reliable mechanism for confirming that the declared scope matches the actual environment.
What Cyber Essentials gap analysis finds across environments
Assessment base: Vulnox gap analysis and Cyber Essentials readiness assessments, UK SMB and mid-market clients, 2023-2025
Protection controls configured in non-enforcing modes
WAFs in log-only or simulation mode appear consistently in e-commerce and SaaS environments where the WAF was deployed during a migration or launch project and never transitioned from the initial configuration. The implementation team sets log-only mode to avoid blocking legitimate traffic during go-live. The transition to blocking mode is deferred, then forgotten. The Cyber Essentials self-assessment question asks whether web application protection is in place. Log-only mode is, technically, in place. The same pattern appears with endpoint protection products in detect-only configurations, email filtering rules set to quarantine rather than block, and IDS systems that generate alerts without automated response.
Self-assessment answers describing protection controls that are deployed in non-enforcing configurations are not inaccurate — the control exists. They are misleading about the protection provided. A gap analysis that tests control enforcement rather than control existence finds this category of failure reliably. For Cyber Essentials purposes, a control that does not prevent or block the threat it is documented as preventing does not satisfy the requirement, regardless of what the self-assessment answer says.
Default credentials on OT-adjacent and network infrastructure devices
Manufacturing environments, logistics operations, and any organization running OT or OT-adjacent equipment consistently have devices with unchanged default credentials in operational use. The Cyber Essentials secure configuration requirement under Requirement 5 applies to all devices in scope. The self-assessment asks whether default passwords have been changed. The answer is yes for the devices the internal team thinks of when answering the question — workstations, servers, managed network equipment. PLCs, HMIs, IP cameras, environmental monitoring systems, and network-attached production equipment are answered for less reliably, either because they are not considered in scope or because the person answering does not have visibility into their configuration. External device enumeration finds them.
Default credentials on any in-scope device are a Cyber Essentials failure regardless of whether the device is considered 'IT' or 'OT.' More practically, a device with default credentials that has network connectivity — even limited connectivity — provides a path to whatever that device can reach. The lateral movement risk from a PLC with default credentials depends on network architecture, but the Cyber Essentials compliance failure is unconditional.
Boundary firewall assessment that passes inbound and misses egress
Cyber Essentials Requirement 1 specifies that boundary firewalls should be configured to block unauthorized inbound access. It does not explicitly require egress filtering. Organizations that configure inbound rules correctly and pass the self-assessment frequently have no egress controls beyond the default outbound allow-all that most firewall configurations ship with. Internal systems — including potentially compromised systems — can initiate outbound connections to any external destination without restriction. DNS egress is the most commonly exploited path because DNS traffic is operationally necessary and rarely filtered. A system establishing command-and-control communication over DNS on port 53 traverses most Cyber Essentials-compliant firewall configurations without challenge.
Passing Cyber Essentials Requirement 1 does not mean an organization's firewall controls are adequate for their threat model. It means their inbound rules satisfy the scheme's documented requirements. The absence of egress filtering is not a Cyber Essentials compliance failure — it is a security gap that the scheme does not address. Organizations preparing for Cyber Essentials Plus should review egress filtering specifically because an active technical assessment will expose the absence of outbound controls in a way the self-assessment cannot.
The self-assessment answer that passes and the control that fails
Common belief
Organizations approaching Cyber Essentials gap analysis typically expect the gaps to be in controls they have not implemented at all — missing MFA, no patch management process, no documented firewall rules. They expect to find absence, not misconfiguration. The remediation they plan for is implementing missing controls.
What we found
In Cyber Essentials readiness assessments, the ratio of misconfiguration findings to missing control findings is consistently higher than clients expect. Organizations anticipating a list of missing controls receive a list that is predominantly misconfigured, non-enforcing, or out-of-scope controls that they believed were in place and effective. The self-assessment answers for these controls were accurate descriptions of what the organization understood about them. The technical assessment found what the organization did not know about them.
The actual finding pattern is different. Organizations that commission a gap analysis before certification, or before a Plus attempt, typically have the controls in place. They have a WAF, a patch management process, MFA on user accounts, firewall rules. The gaps are not in control existence — they are in control effectiveness.
This matters for remediation planning. Implementing a missing control takes a defined amount of time and effort. Identifying that an existing control is misconfigured, non-enforcing, or applied to a subset of the required scope requires a different kind of investigation — one that starts from the control's actual behavior rather than its documented configuration.
The counterintuitive finding is that organizations with more mature security programs are not reliably better prepared for Cyber Essentials gap findings than organizations with less mature programs. The maturity of the program predicts control existence well. It predicts control effectiveness less reliably, because mature programs accumulate the same configuration drift, scope gaps, and non-enforcing defaults as less mature ones — they just have more of them distributed across more controls.
What Cyber Essentials gap analysis misses when it starts from the questionnaire
Cloud services and SaaS platforms inside the scope boundary
Cyber Essentials scope includes cloud services where the organization is responsible for configuration. Most self-assessments declare a scope boundary around on-premises infrastructure and managed devices. Cloud storage, SaaS platforms processing organizational data, and cloud-hosted services are in scope by the scheme's definition if they fall within the organizational boundary — but they are frequently not included in the self-assessment answers because the person answering the questionnaire is thinking about the on-premises environment. A misconfigured S3 bucket, a cloud application with public access enabled, or a SaaS tool with insecure default settings fails Cyber Essentials requirements regardless of whether it was included in the scope declaration.
Contractor and remote worker devices in operational use
Cyber Essentials requires that all devices used to access organizational systems and data be in scope. Contractor devices, personal devices used under BYOD policies, and remote worker devices managed outside the organizational MDM are in scope if they access organizational resources. Self-assessments routinely declare these devices out of scope or address them with a BYOD policy document rather than a technical control verification. An external assessment that enumerates devices connecting to organizational systems finds them. The self-assessment answer that the organization's devices are secured does not address contractor devices that are also connecting.
Patching coverage gaps in cloud-managed and ephemeral infrastructure
Patch management processes are documented against the systems the IT team manages directly. Cloud-managed services that handle their own patching, container deployments with base images that are not regularly rebuilt, and development or staging environments treated as non-production can be excluded from patching documentation while running software with known vulnerabilities. Cyber Essentials Requirement 2 requires that all in-scope software be patched within defined timeframes. The self-assessment answer describes the patching process for managed systems. Technical assessment finds what the patching process does not manage.
User account scope in Requirement 3
Cyber Essentials Requirement 3 covers access control and requires that user accounts have appropriate access controls including MFA for cloud services. Self-assessment answers describe MFA implementation for user accounts in the organizational directory. Service accounts, application integration accounts, shared accounts, and legacy accounts created before MFA policies were implemented are answered for less consistently. These account types are in scope for Requirement 3. A technical review of account configurations finds them. They appear in external reconnaissance of authentication endpoints as accounts that accept password-only authentication against services where the organization reports MFA is enforced.
What organizations say before a Cyber Essentials gap analysis — and what it means
'We certified last year with no issues. We just need to renew — nothing significant has changed.'
Root cause:Cyber Essentials certification is annual. The self-assessment reflects the environment as understood at the time of completion. In the 12 months between certifications, devices are added, cloud services are adopted, contractor relationships change, and configurations drift. 'Nothing significant has changed' is the assessment of the person who has been inside the environment throughout that period. An external review starting from asset discovery rather than the previous year's answers regularly finds changes the internal team did not consider significant and the scheme considers in scope. The previous certification confirms the environment was compliant when assessed. It predicts nothing about current state.
'We have MFA on everything — we use Microsoft 365 and MFA is enforced at the tenant level.'
Root cause:Microsoft 365 tenant-level MFA enforcement applies to accounts in the tenant authentication policy scope. Conditional access exclusions, legacy authentication protocols, service accounts with application passwords, and guest accounts with different policy application are common exclusions that are not captured by the statement that MFA is enforced at tenant level. A review of the tenant's conditional access policies and authentication logs finds the accounts and protocols that authenticate without MFA. The tenant-level enforcement is real. It covers a subset of authentications. The subset is what matters for Cyber Essentials Requirement 3.
'Our firewall is managed by our MSP and they confirm it's configured to Cyber Essentials requirements.'
Root cause:MSP confirmation of firewall configuration describes the firewall's inbound rule configuration against the MSP's Cyber Essentials configuration standard. It does not describe the full network topology, does not address egress filtering, does not cover network-connected devices outside the MSP's management scope, and does not account for changes made outside the MSP's change management process. The MSP's confirmation is accurate for what the MSP manages and knows about. The gap is in what the MSP does not manage or know about, and in the difference between inbound rule compliance and effective boundary control.
Where Cyber Essentials is heading
NCSC will introduce mandatory external asset discovery as a prerequisite for Cyber Essentials scope declaration within 3 years, requiring organizations to reconcile their declared scope against externally discoverable assets before self-assessment answers are submitted.
The scheme's scope definition weakness is the mechanism behind its most consistent compliance failures. Organizations declare a scope, answer questions about it, and receive certification for it — without any verification that the scope matches the actual environment. The technical capability to run automated external asset discovery at scale exists and is inexpensive. The regulatory logic for requiring it is straightforward: a certification that covers a declared environment that does not match the actual environment provides assurance that does not reflect reality. Pressure from the UK government's supply chain security agenda will eventually produce a scope validation requirement.
Confidence: mediumCyber Essentials scheme updates published by NCSC between 2025 and 2028. If updated scheme documentation does not introduce scope validation requirements, this prediction is wrong.A UK government supplier will lose a contract following a breach where the initial access vector was a device or service in scope for Cyber Essentials but excluded from the certification's declared boundary, and the resulting guidance will make scope completeness an explicit audit item in the Plus assessment.
The structural conditions exist: organizations certify against declared scopes that do not match their actual environments, and the Plus assessment currently verifies control implementation within the declared scope rather than verifying scope completeness. A breach that traverses an in-scope-but-undeclared asset will produce a finding about scope methodology in the post-incident review. The consequent scheme update is the predictable regulatory response.
Confidence: highNo publicly documented contract action or scheme methodology change related to Cyber Essentials scope completeness by May 2028. This would suggest the structural gap is less prevalent or less exploited than assessment data indicates.
What Cyber Essentials is good for and what it is not
Cyber Essentials does something useful: it establishes a minimum baseline for organizations that would otherwise have no structured approach to the five control categories. For a 20-person professional services firm that has not thought systematically about boundary firewalls, patch management, or access control, working through the self-assessment is a genuine improvement. The scheme is well-designed for that audience.
The problem is that Cyber Essentials certification has become a supply chain requirement for UK government contracts and increasingly for private sector procurement. That use case implies the certification provides assurance about security posture. Self-assessment against a questionnaire provides assurance about documented controls described by internal staff. These are different things, and the gap between them is where supply chain risk concentrates.
Cyber Essentials Plus is the version that provides the assurance the certification is assumed to provide. It involves external technical verification and produces results that are meaningfully different from the self-assessment in a predictable direction — the technical assessment finds what the self-assessment cannot. Using Plus certification as the supply chain assurance requirement would close the gap. The scheme's cost and accessibility design makes that a difficult policy position. But the current state, where the self-assessment certification is treated as equivalent assurance to external technical verification, is not accurate.
Counterargument
The counterargument is that requiring Plus certification for all government supply chain relationships would exclude smaller suppliers who cannot afford the more rigorous assessment, reducing competition and market access for UK SMBs. This is a real policy concern. The response is not that the assurance gap does not exist — it is that the scheme should be transparent about what each level provides, so that procurement decisions can be made with accurate information about what the certification actually verifies.
Running a Cyber Essentials gap analysis that finds real gaps
Step 1 — external asset discovery before scope declaration. Organizations define their Cyber Essentials scope based on what they know about their environment and then answer the self-assessment questions for that scope. The gap between the declared scope and the actual external asset inventory is where the most consequential certification failures originate, and it is the step that requires external tooling rather than internal documentation review.
- 1IT lead or external assessor
Run external asset discovery before defining the self-assessment scope. Use certificate transparency log queries against the organization's primary domains, passive DNS enumeration, and port scanning of the organization's IP ranges to build an external asset inventory. Compare the result against the planned self-assessment scope declaration. Any asset in the external inventory that is not in the planned scope declaration is either a scope gap or an exclusion that needs explicit justification.
Expected outcomeA reconciled scope declaration that matches the external asset inventory, eliminating the most common source of Cyber Essentials certification failures — certifying against a scope that does not include all in-scope assets.
- 2IT lead or assessor
For each protection control described in the self-assessment answers — WAF, endpoint protection, email filtering, IDS — verify enforcement mode rather than deployment status. Check the WAF management console for the current mode setting. Check the endpoint protection platform for any endpoints in detect-only or passive mode. Check email filtering rules for quarantine-rather-than-block configurations. Document the enforcement status separately from the deployment status.
Expected outcomeA control enforcement inventory that distinguishes between controls that are deployed and controls that are actively blocking the threats they are documented as protecting against. Any control in a non-enforcing mode is a gap regardless of the self-assessment answer.
- 3IT lead
Pull the user account list from the directory and identify every account type that is not a standard user account: service accounts, shared accounts, application integration accounts, break-glass accounts, and accounts created before current MFA policy was implemented. For each, check whether MFA applies. Accounts that authenticate to cloud services without MFA are a Requirement 3 gap regardless of whether the organizational MFA policy document covers them.
Expected outcomeA complete account inventory with MFA status per account, identifying any authentication paths to cloud services that operate without MFA enforcement.
- 4IT lead or network team
Review network-connected devices that are not in the organizational endpoint management platform: IP cameras, printers, network-attached storage, OT-adjacent equipment, environmental monitoring systems, and any device that has a network interface and an IP address but is not managed through the standard device management tooling. For each device, check the current credential configuration against the vendor default. This is the check the self-assessment cannot run and the Plus assessment will.
Expected outcomeAn inventory of unmanaged network-connected devices with their credential status, identifying any device with unchanged default credentials that is in scope for Cyber Essentials Requirement 5.
One thing to do this week
Find every WAF, endpoint protection product, and email filtering system in your environment and check the enforcement mode setting in the management console — not the policy document, the console. Log-only, simulation, detect-only, passive, monitor mode: whatever your vendor calls it, it means the control is not blocking anything.
If every protection control you have is in enforcing mode, you have confirmed the most common Cyber Essentials compliance failure does not apply to your environment. That takes an hour and produces a finding worth knowing before a Plus assessor finds the opposite.
If any control is in a non-enforcing mode, you have found a gap that your self-assessment answers described around. Switching a WAF from log-only to blocking mode is a configuration change. The risk of breaking legitimate traffic is real and worth testing carefully. The risk of leaving it in log-only mode and certifying that web application protection is in place is also real, and tends to surface at worse moments.
Further Reading
Gap Analysis
Cyber Essentials gap analysisDigital Footprint
digital footprint analysisNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkDigital Risk Protection
digital risk protection guide
Frequently Asked Questions
What does a Cyber Essentials gap analysis find that the self-assessment misses?
Cyber Essentials gap analysis finds controls that exist but do not operate as documented: WAFs in log-only mode that pass the self-assessment question about web application protection while blocking nothing, endpoint protection in detect-only configuration, MFA policies that exclude service accounts and legacy authentication protocols, and default credentials on OT-adjacent devices that are in scope but outside the self-assessment's documentation review scope. The self-assessment verifies that controls are described correctly. A gap analysis verifies that they operate as described.
What is the difference between Cyber Essentials and Cyber Essentials Plus for gap analysis purposes?
Cyber Essentials is self-assessed: the organization describes its controls and the certification is granted based on those descriptions. Cyber Essentials Plus involves external technical verification — vulnerability scanning, configuration review, and active testing — that produces findings the self-assessment cannot. Organizations that pass Cyber Essentials self-assessment and then prepare for Plus certification consistently find gaps between self-assessed and externally verified compliance. A gap analysis that replicates the Plus methodology finds those gaps before the formal assessment, at lower cost than a failed Plus attempt.
What are the most common Cyber Essentials Requirement 5 failures in practice?
The most consistent Requirement 5 failures are default credentials on devices outside the standard IT management scope: PLCs and HMIs in manufacturing environments, IP cameras and network-attached equipment in office environments, and network infrastructure devices managed outside the organizational endpoint management platform. These devices are in scope for Secure Configuration requirements because they have network connectivity and operate in the organizational environment. They are answered for inconsistently in self-assessments because the person completing the assessment is thinking about managed IT assets, not every network-connected device.
Does passing Cyber Essentials Requirement 1 mean the boundary firewall is effectively configured?
Passing Requirement 1 means the inbound firewall rules satisfy the scheme's documented requirements for blocking unauthorized inbound access. It does not address egress filtering. Cyber Essentials does not explicitly require controls on outbound traffic. Organizations with correctly configured inbound rules and no egress filtering pass Requirement 1 while leaving internal systems free to initiate outbound connections to any external destination, including attacker-controlled infrastructure. The compliance pass is accurate. The security gap is real and not addressed by the scheme.
How should Cyber Essentials scope be defined before self-assessment?
Scope should be defined after external asset discovery, not before it. Running certificate transparency log queries, passive DNS enumeration, and IP range scanning against the organization's domains and address space produces an external asset inventory. That inventory should be the basis for the scope declaration. Any externally discoverable asset that falls within the organizational boundary is in scope by the scheme's definition. Defining scope from internal knowledge and then answering self-assessment questions for that scope produces a certification that applies to what the organization knows about, not necessarily to what exists.
How often should a Cyber Essentials gap analysis be performed?
At minimum, before each annual certification renewal and before any attempt at Cyber Essentials Plus. Additionally, a scope validation check should be run after any significant change: cloud service adoption, new system deployments, contractor relationship changes, or network architecture modifications. These changes can bring new assets into scope or create new gaps in existing controls without triggering an internal review. The certification cycle does not align with the rate at which environments change, and relying on the annual renewal as the only gap analysis mechanism means discovering changes at certification time rather than when they occur.
What should organizations check specifically when preparing for Cyber Essentials Plus?
Plus preparation should cover four areas that self-assessment cannot verify: enforcement mode for all protection controls (WAF, endpoint, email filtering); credential configuration for all network-connected devices including those outside IT management scope; MFA coverage for all account types including service accounts and legacy accounts; and scope completeness via external asset discovery reconciled against the declared boundary. These are the areas where the Plus technical assessment consistently finds gaps in environments that passed self-assessment.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.