SIFTRCyber readiness Start the free check

BetaThis is a new, free service. Tell us what you think.

Under attack right now? Get help
  1. Call your IT support straight away. They’ll tell you what to disconnect.
  2. England, Wales and Northern Ireland: if the attack is happening now, call Report Fraud on 0300 123 2040, open 24 hours a day for businesses under live attack. Otherwise, report it at reportfraud.police.uk.
  3. Scotland: call Police Scotland on 101.
  4. If personal data may be affected, you may need to tell the ICO within 72 hours. Report a breach to the ICO.
  5. Tell your cyber insurer, if you have one.

Contact details checked on 5 November 2026. SIFTR isn’t an emergency service.

01 / For UK small businesses

From “not sure” to ready for Cyber Essentials.

Fifteen plain-English questions show where you stand, what to fix first and who can do it. You also get a free starter policy pack.

Start the free check

About three minutes. No account needed. Nothing to install.

02 / SIFTR · READINESS MATRIXExample business

One business, 15 answers, five areas. Choose any square.

Know your risks

Your people

Connected systems and suppliers

Keeping the business running

Standards and proof

  • In place
  • Partly
  • No
  • Not sure

Your people

Do you use two-step login (a code or app as well as a password) on email and key systems?

Answer: Not sure

Next action

Not sure yet: find out

Find out: Is two-step login (multi-factor authentication) switched on for everyone's email and our key systems? Which ones don't have it yet?

“Not sure” isn’t “No”. Ask IT support, then come back with Yes, Partly or No.
Show the request for IT support

Hi, Could you tell me, please: Is two-step login (multi-factor authentication) switched on for everyone's email and our key systems? Which ones don't have it yet? It’s for our cyber security checklist. Thanks.

Your action plan: 10 tasks. 5 already in place. Find-out tasks come first.

  1. T-01Find out: Is two-step login (multi-factor authentication) switched on for everyone's email and our key systems? Which ones don't have it yet?Your people · Ask IT supportNot sure yet
  2. T-02Find out: Do we have a written plan for keeping the business going after a cyber attack?Keeping the business running · Ask your directorsNot sure yet
  3. T-03Keep a contact sheet (IT support, insurer, key customers) and run a 30-minute practice once a year.Keeping the business running · Usually you · this weekTo do
  4. T-04Book a yearly risk review, even a one-hour meeting, and write down what you decide.Know your risks · Usually you · this monthTo do
  5. T-05Run a short awareness session every year and brief new starters in their first week.Your people · Usually you · this monthTo do
  6. T-06Set a regular update routine, and keep a list of anything that can’t be updated and how you protect it.Connected systems and suppliers · Usually IT support · this monthTo do
  7. T-07Keep a backup copy offline or separate, and test restoring from it at least twice a year.Keeping the business running · Usually IT support · this monthTo do
  8. T-08Collect your policies, certificates and test results in one folder so you can answer customer questions quickly.Standards and proof · Usually you · this monthTo do
  9. T-09Start with three short policies: passwords and access, acceptable use, and reporting incidents.Standards and proof · Usually you · this monthTo do
  10. T-10Ask your IT support to put key equipment, such as machines, tills or cameras, on a separate network from everyday computers.Connected systems and suppliers · Usually IT support · this quarterTo do

Champion builds this plan from your answers. It opens soon; until then, the free check gives you the same priorities.

03 / Trust

Honest about what it is.

SIFTR gets you ready. It doesn’t certify you.

  • Your answers stay in your browser

    We don’t receive them. Sharing a results code with an adviser is up to you. Clearing your browser data deletes them, so Champion lets you save a backup file.

  • Readiness, not certification

    It isn’t an audit, a certification or an official scheme. Only a licensed certification body can award Cyber Essentials. SIFTR GOVTECH LTD holds Cyber Essentials itself. About Cyber Essentials and the free Cyber Essentials Readiness Tool from IASME and the NCSC.

  • Support from SIFTR

    An independent service from SIFTR GOVTECH LTD. If you get stuck, email support@siftr.so and you’ll hear back from a person.

04 / Questions

Questions

Short answers to what people ask first.

How much does it cost?

The free check and Champion are free.

Readiness reviews signed off by a person, and work with councils and programmes: Price on request. Ask us.

Who sees my answers?

Only you, unless you choose to share them. Sharing is optional.

The check and Champion run in your browser and we don’t receive your answers. When you carry on from the check into Champion, your answers go in the link itself, not to us.

If you choose to send your results code to an adviser or council, they can see your answers but not your name or email.

Do I need to be technical?

No. The questions are in plain English. If you don’t know an answer, choose “Not sure”, and you’ll be told who to ask, for example your IT support.

05 / Start

Three minutes from now, you’ll know where you stand.

Free. No account. Your answers stay on your device.

Start the free check