Cyber Essentials checklist: everything to have in place before you apply

Cyber Essentials or Cyber Essentials Plus?

Both certify the same five controls. The difference is how they are checked. The scheme is run by the National Cyber Security Centre, with IASME as its delivery partner, and certificates are issued by certification bodies that IASME licenses.

Who needs it? Many UK central government contracts that involve personal data or certain ICT services require it. Larger customers increasingly ask for it in supplier questionnaires, and insurers ask about it at renewal. Even without anyone asking, the five controls stop most common attacks.

Decide your scope

Scope is where most of the work is, and where most surprises come from. Certifying the whole organisation is simplest. You can certify a defined part instead, if it is separated from the rest by a firewall or its own network, but the certificate then covers only that part and says so.

• Every device that reaches the internet and is used for work: laptops, desktops, thin clients, servers, phones and tablets.
• Network devices: routers and firewalls.
• Cloud services you use: email, file storage, accounting, CRM. You are responsible for the security settings you control in each, even though the provider runs it.
• Home and remote workers. Their home routers are out of scope unless you supplied them, so the firewall on the device itself does the job.
• Personal devices that reach work email, chat or files. These are the ones most often forgotten.

Firewalls

• A firewall on every internet connection: usually your router or a dedicated firewall in the office.
• Its default administrator password changed to a strong, unique one. Default passwords for most routers are published online.
• Inbound connections blocked by default. Any port you open has a written business reason, and is closed when it is no longer needed.
• Remote administration switched off, or protected by multi-factor authentication or limited to a list of known addresses.
• The software firewall switched on on every laptop and desktop, which matters most on home, hotel and café networks.

Secure configuration

• Remove or disable what you do not use: software, apps and accounts, including guest accounts and the trial software that comes pre-installed.
• Change default passwords before any device or service is used.
• Turn off auto-run, so nothing opens by itself from a USB drive or a download.
• Devices lock: a PIN or password, or a fingerprint or face, to unlock, and they lock themselves after a short time.
• Protection against password guessing: lock after no more than ten failed attempts, or slow the attempts down.

Security update management

• Everything in scope must be supported and still receiving security updates from its maker. Software past its end-of-support date fails outright, so remove it or move it onto a separate network outside the scope.
• High-risk and critical updates installed within 14 days of release. These are the ones rated 7 or above on the common scoring scale, or described by the vendor as critical or high risk.
• Automatic updates on wherever the software allows it.

User access control

• Everyone has their own account. No shared logins for everyday work.
• A process for accounts: created only when approved, and removed promptly when somebody leaves or changes role. Write down who approves and who removes.
• Only the access each person needs.
• Separate administrator accounts, used only for administration, never for email or browsing.
• Multi-factor authentication on every cloud service that offers it, for every user. Start with email and administrator accounts.
• Strong passwords where multi-factor authentication is not available, such as at least 12 characters, or 8 with common passwords blocked, and protection against guessing.
• Review who has administrator rights at least once a year. It is good practice, and the easiest way to show the rest is true.

Malware protection

• Anti-malware on every laptop, desktop and server that updates itself, scans files as they are opened, and warns about or blocks malicious websites. The protection built into current operating systems meets this when it is switched on.
• Or application allow-listing where anti-malware cannot run: only approved software is allowed to run.
• Phones and tablets install apps only from official app stores.

Where first attempts go wrong

1. An unsupported operating system somewhere in scope. The old laptop in a drawer that still connects counts.
2. A cloud service that offers multi-factor authentication without it switched on.
3. Updates older than 14 days on a device someone forgot.
4. Administrator accounts used for everyday work.
5. A router or firewall on its default password, or with its admin page open to the internet.
6. A scope that leaves out home workers, phones or a cloud service.
7. Answers that describe what you intend rather than what is true today. The declaration is signed by a director, so every answer has to be true on the day.

How certification works

1. Get ready with the checklist below.
2. Choose a certification body licensed by IASME, and buy the assessment. The fee depends on the size of your organisation.
3. Answer the questionnaire online. A board-level person, or equivalent, signs the declaration.
4. The certification body checks your answers, and either certifies you or tells you what does not meet the requirements.
5. For Cyber Essentials Plus, book the hands-on audit within three months.
6. Renew every 12 months. Check which version of the requirements applies when you apply: the NCSC updates them from time to time.

The checklist

Work through it before you buy the assessment. Ticks are kept in this browser, and it prints cleanly.

Prepare in Comply

The same checklist, question by question, with the evidence for each answer attached to it, ready-made security policies to adapt and approve, and security training for your staff with certificates. Assets holds the device list the assessor asks for, and Access reviews records who has administrator rights and checks that leavers lose access. Your Cyber Essentials certificate itself comes from a certification body licensed by IASME.

Get started with Essentials See Comply Essentials: £119 a month, with a 14-day trial.

Questions people ask

Keep going

Where this comes from

• NCSC: Cyber Essentials overview
• NCSC: the current requirements and question set
• IASME: Cyber Essentials

This guide summarises the Cyber Essentials requirements in plain English. The requirements are updated from time to time, so check the current version on the NCSC's pages before you apply.