How does the compliance score work?
The Cyber Essentials page scores your organisation against each of the five technical controls, then averages them into one overall score.
Per-control scoring
Each control is scored as a percentage of your active devices, software, and user accounts that meet its requirement:
| Control | Passes when | |---|---| | Firewalls | Firewall Enabled is set to Yes | | Secure Configuration | Default Creds Changed and Hardening Baseline are both Yes | | User Access Control | Every admin account has MFA enabled (non-admin accounts always count as compliant) | | Malware Protection | AV Real-time Scan and AV Auto-update are both Yes | | Patch Management | OS and software patched within the last 14 days |
Each control also lists its specific issues — named devices, software, or accounts — rather than just a percentage, so you know exactly what to fix.
Overall score
Your overall score is the average of all five control scores. A device, software record, or account with fields left blank counts against you the same way a field set to "No" does — Cyber Essentials treats "not recorded" as "not confirmed," since an assessor would do the same.
Tip
The fastest way to move your score is to work through the issues list under each control rather than the overall percentage — each entry links straight to the record that needs updating.
Why the score might drop after "fixing" something
If you edit a device or account and the score doesn't move the way you expect, check that you actually saved the specific field the control checks — for example, updating AV Product alone doesn't affect the Malware Protection score; AV Real-time Scan and AV Auto-update are what's checked.