IASME’s free Cyber Essentials Readiness Tool vs BrightCert: what’s the difference?

This isn’t a “which one’s better” question. It’s “which one gives you what you actually need right now.”

What IASME’s Readiness Tool actually is

The Cyber Essentials Readiness Tool is built by IASME, the NCSC’s official Cyber Essentials Delivery Partner, and it’s a genuinely good starting point. It’s an interactive questionnaire, written in plain English, that assumes no technical knowledge. You work through it at your own pace, can save progress and come back later, and at the end you get a tailored action plan you can download or print.

Where you’ve answered “no” or “I don’t know” to a question, the tool tells you what to do about it or points you to guidance. It’s completely free, and it’s the same organisation that will eventually certify you, so nothing about your prep is off-brand from what the real assessment expects.

For applications started from 27 April 2026, the formal self-assessment uses the Danzell question set and Cyber Essentials requirements v3.3. IASME’s Readiness Tool and BrightCert both help you prepare, but neither is the formal Danzell application and neither issues the certificate. Under v3.3, multi-factor authentication must be enabled for users of cloud services where the service makes MFA available.

What it doesn’t give you

The Readiness Tool is deliberately a guidance tool, not an assessment tool. Three specific gaps, if you’ve used it:

• No score. You finish knowing which questions you answered “no” to, but not how ready you are overall, or how your Firewalls control compares to your Malware Protection control. There’s no single number to track improvement against.
• No prioritisation. If you’ve got eight gaps, the tool doesn’t tell you which one is the biggest risk to fix first. Every “no” gets the same generic next-step guidance, regardless of how serious it is.
• Nothing to hand to someone else. If a director, an investor, or an IT provider asks “where do we actually stand?”, there’s no polished output to send them, just your own notes from working through the questionnaire.

None of that is a criticism of the tool for what it’s built to be. It’s a free, official first step, not a management report.

What BrightCert adds

BrightCert covers the same ground, the same five official Cyber Essentials control areas, but the output is different:

• A readiness score (0–100%) overall and per control area, so you know exactly how close you are and where the weakest area is
• Gaps explained in plain English, written per-answer rather than generic guidance for a “no”
• A prioritised fix list(P1/P2/P3) so you know what to fix first if you can’t fix everything at once
• A downloadable PDF report, something you can actually send to a director, a tender panel, or your IT provider

The assessment itself is free to complete, same as IASME’s tool. The scored report and PDF are £99 including VAT with code FOUNDING10, a £100 founding discount from the standard £199 price, for the first 10 customers.

Side by side

Which should you use?

If you just want to understand the Cyber Essentials requirements and get pointed toward what to fix, start with IASME’s tool. It’s free, official, and a good use of twenty minutes.

If you need a number to track, a ranked list of what actually matters most, or a document to show someone else, that’s the specific gap BrightCert fills. Several businesses use IASME’s tool first for general orientation, then run a BrightCert assessment closer to the point where they’re actually about to apply and need something concrete to act on.

Neither tool, free or paid, issues the actual Cyber Essentials certificate. That step always goes through an IASME-licensed Certification Body.