Sample · demo data · fictional client

Cyber Essentials readiness report

This is what an MSP or a business gets from CyberSpec for one client: the five Cyber Essentials controls, what the CE+ external scan would likely find, and a fix list in priority order. In the portal this is the Readiness page filtered to the client; the PDF you download lists every finding with its fix. The client, hosts and addresses below are made up.

Client: Example Dental Practice Ltd
Assets: 2 domains, 1 IP
Last scan: 10 Nov 2026
Scheme version: v3.3 (Danzell)

Summary

One control would likely fail the CE+ external scan today: an internet-facing web server runs Apache with a known exploited vulnerability scoring 7.5. Two controls need review because Remote Desktop and a WordPress admin login are reachable from the internet. Fixing the two immediate items removes the likely fail; the review items need either a change or a documented business need.

Summary written by AI from the scanner's own findings, labelled as AI in the real report.

The five controls

Security update management
Likely failExternal scan
Two findings: Apache httpd 2.4.49 with CVE-2021-41773 (CVSS 7.5), and PHP 7.4, which reached end of life on 28 November 2022. The Apache version fails the CE+ external scan on its own: any internet-facing service with a vulnerability scoring 7.0 or more fails. PHP 7.4 fails the requirements rather than the scan rule: unsupported software must be removed or cut off from the internet.
Firewalls
ReviewExternal scan
Two exposed services: Remote Desktop (3389/tcp) and a WordPress admin login. Each needs a documented business need; an exposed admin interface also needs MFA or an IP allow list.
Secure configuration
ReviewExternal scan
Directory listing is enabled on one web server. Unnecessary features should be removed or disabled.
User access control
AttestedCustomer attested
An external scan cannot see accounts or MFA. The client confirmed the v3.3 statements on 3 November 2026.
Malware protection
Not attestedCustomer attested
An external scan cannot see endpoint protection. Not yet confirmed by the client.

Fix list

Priority	Finding	Where	Fix
Immediate	Apache httpd 2.4.49 — CVE-2021-41773, path traversal, CVSS 7.5, on CISA KEV	www.example.com (203.0.113.10:443)	Upgrade Apache httpd to 2.4.51 or later, then re-scan.
Immediate	PHP 7.4 — end of life since 28 November 2022	www.example.com (203.0.113.10:443)	Move the site to a supported PHP version (8.2 or later) and confirm the CMS and plugins support it.
Soon	Remote Desktop exposed to the internet	203.0.113.25:3389	Put RDP behind the VPN or an IP allow list. If it must stay, record the business need and enforce MFA.
Soon	WordPress admin login reachable from anywhere	www.example.com/wp-admin	Restrict /wp-admin by IP or put it behind MFA, and record why it is public.
Planned	Directory listing enabled	files.example.com (203.0.113.11:443)	Turn off directory indexing (Options -Indexes in Apache) and remove files that should not be public.

Hygiene items outside the five controls (for example TLS 1.0 still offered) are listed separately in the real report; they do not affect Cyber Essentials.

What this report is not

It is a readiness indicator. An assessor verifies every finding during the CE+ test and may rule some out, and two controls can only be confirmed by the client. Certification is issued only by IASME and its certification bodies. See what each control needs.

Start free scan See pricing