Cyber Essentials checklist: the five controls, checked against v3.3

What Cyber Essentials checks, and what it leaves out

The NCSC calls Cyber Essentials “the minimum standard of cyber security recommended by the Government for organisations of all sizes”. There are two levels. Cyber Essentials is a verified self-assessment: you answer a question set, a board member or equivalent signs it off and an assessor marks it. Cyber Essentials Plus covers the same five controls and adds independent technical testing.

Two things are not controls:

• Backups. Backing up “is not a technical requirement of Cyber Essentials”, but the NCSC highly recommends it. Turn on automatic backups where offered, and unplug any USB backup drive between backups.
• Asset management. Not a control either, but the NCSC calls it “a core security function”. You cannot answer the questions without knowing what you own.

Scope first: the Cyber Essentials requirements that catch small firms out

The requirements tell you to “establish the boundary of scope” before anything else.

• □Whole organisation or a sub-set. The NCSC says whole-organisation scope gives the best protection. A sub-set must be separated by a firewall or VLAN and justified to your assessor. Agree the scope with your certification body before assessment begins.
• □End-user devices are in. “A scope that doesn’t include end-user devices isn’t acceptable.”
• □Cloud services are in. New in v3.3: “Cloud services cannot be excluded from scope.” Microsoft 365, Google Workspace, Dropbox and your cloud accounting software all count if they hold your data.
• □Staff-owned devices are in if they access work data or services. A phone used only for calls, texts and an MFA app is out.
• □Home workers’ laptops are in. A router you supply is in scope. Their own broadband router is not, so the laptop needs its own firewall on.
• □Accounts your IT supplier uses are in. Every account your organisation owns counts, even when a supplier or managed service provider uses it.

This week: make one list. Every laptop, desktop, server, phone and tablet that touches work email or files, every router and firewall, and every cloud service with a business login. Note the owner, operating system and version. Everything below builds on it.

The Cyber Essentials checklist, control by control

Tick an item only when you have supporting evidence. Use the official v3.3 document and the current assessment questions to confirm the full requirements for your scope.

1. Firewalls

Aim: “only secure and necessary network services can be accessed from the internet.”

• □Every in-scope device sits behind a correctly configured firewall or runs its own software firewall.
• □The router’s default admin password is replaced with a strong, unique one, or remote admin is off.
• □The admin interface cannot be reached from the internet, unless there is a documented business need and it is protected by MFA or by an IP allow list plus a properly managed password.
• □Unauthenticated inbound connections are blocked by default.
• □Each inbound rule, such as a port forward, is approved by an authorised person, with the business need written down.
• □Rules nobody needs any more are removed or disabled.
• □Laptops used on public wifi have their software firewall on.

This week: log in to the office router. Is it still on the password from the sticker? Is remote management on? List each port forward and why it exists. Microsoft says Windows Firewall is “enabled by default on all Windows editions”, so if a laptop has it off, find out why. The NCSC advises turning on the built-in firewall in preference to a third-party one.

Keep: a router settings screenshot and a list of inbound rules with owners and reasons.

2. Secure configuration

Aim: devices that “provide only the services required to fulfil their role”.

• □Unused accounts are removed or disabled, including guest accounts and spare admin accounts.
• □Default or guessable passwords are changed.
• □Software nobody needs is removed: applications, system utilities and network services.
• □Auto-run that opens files without the user’s say-so is off.
• □Users sign in before they reach organisational data or services.
• □Every device needs a password, PIN or biometric before anyone can use it.
• □That sign-in is protected against guessing: no more than 10 attempts in 5 minutes, or a lock-out after no more than 10 failures. Where the vendor won’t let you change this, its default applies.
• □A device PIN or password is at least 6 characters. If it also signs the user in to services, the full password rules in control 4 apply.

This week: pick three laptops used by three different people. Identify unfamiliar or unused applications and confirm with your IT owner which can be removed safely. Check that unused guest accounts are disabled. On phones with work email, check the screen lock is on with a PIN of six digits or more.

Keep: app lists before and after, and your screen-lock settings.

3. Security update management

Aim: devices and software that “are not vulnerable to known security issues for which fixes are available.”

• □All software in scope is licensed and supported. That includes operating systems, apps, extensions, and router and firewall firmware.
• □Unsupported software is removed, or moved into a sub-set with no internet traffic in or out.
• □Automatic updates are on wherever possible.
• □Updates the vendor calls “critical” or “high risk”, or that fix vulnerabilities scoring 7 or above on CVSS v3, go on within 14 days of release. So do updates where the vendor gives no severity.
• □A bundled update that includes any critical or high-risk fix goes on within 14 days.

Applying every update within 14 days is strongly recommended but not required.

This week: check each operating system on your list is still supported. For Windows devices, check the exact edition and support arrangements against Microsoft’s lifecycle information, including any applicable extended support. Ask your certification body how these arrangements affect your assessment. Then find phones and tablets that no longer get updates, and check the router firmware.

Keep: the device list with support status, and a screenshot of update settings.

4. User access control

Aim: accounts “assigned to authorised individuals only”, with access limited to what each role needs. Accounts your support providers use count too.

• □New accounts go through a process to create and approve them.
• □Everyone signs in with unique credentials. No shared logins.
• □Accounts are removed or disabled when no longer needed, such as when someone leaves or after a set period of inactivity.
• □MFA is on wherever it is available, and always on cloud services: “authentication to cloud services must always use MFA”.
• □Admins use a separate account for admin work only, never for email or browsing.
• □Admin rights are removed when no longer needed, for example after a change of role.
• □Password guessing is limited by MFA, by throttling to 10 guesses in 5 minutes at most, or by lock-out after 10 failures at most.
• □Password quality is managed by MFA, a 12-character minimum, or an 8-character minimum plus a block on common passwords, with no maximum length. The password part of MFA is at least 8 characters.
• □Staff get help to choose unique passwords, such as three random words and a password manager. Nobody is forced into regular changes or complexity rules.
• □There is a process to change a password quickly if an account may be compromised.

SMS codes count as MFA, but the NCSC recommends other options where they work for you. FIDO2 authenticators count as passkeys and are “regarded as MFA”.

This week: in Microsoft 365, export the user list and compare it with your staff list. Arrange for leaver access to be disabled, taking account of legitimate retention and business-continuity needs. Ask whether each Global Administrator needs the role. Check MFA for every user, not only managers. Microsoft’s free security defaults make all users register for MFA, require it for administrators and block legacy authentication. With Entra ID P1 or P2 licences, Microsoft suggests Conditional Access instead. Our Microsoft 365 security audit guide explains the settings to discuss with your administrator.

As an AI consultancy, we would add AI tools to your list. v3.3 defines a cloud service as one reached through an account that stores or processes your organisation’s data. An AI assistant holding your documents fits that, so on our reading it needs MFA too. Confirm with your certification body, and use our AI policy template to decide which tools staff may use.

Keep: a dated user and admin list, an MFA report and your leaver checklist.

5. Malware protection

Aim: to stop known malware and untrusted software “from causing damage or accessing data.”

Every in-scope device needs at least one of these, active and kept up to date:

• □Anti-malware software, an option for Windows and macOS devices, including servers. It must update as the vendor recommends, stop malware running, stop malicious code executing and block connections to malicious websites.
• □Application allow listing, an option for any device. Only approved, code-signed apps run. You approve apps before they are deployed and keep a current list, and users cannot install apps that are unsigned or have an invalid signature.

This week: on a sample of Windows PCs and Macs, find out which anti-malware tool each one relies on and check it meets all four conditions, including blocking malicious websites. For phones and tablets, the requirements’ own example allows only vetted, code-signed apps from the device’s app store. Ask your certification body how to answer for those.

Keep: protection status screenshots from a sample of devices.

How certification works: self-assessment, assessor, certificate

The NCSC sets out two routes:

1. Self-led. Register with IASME, pay and complete the verified self-assessment online for an assessor to mark.
2. Supported. Hire an IASME-licensed certification body to help you understand the questions. Choose a provider appropriate to your scope and support needs.

Cost. The NCSC says Cyber Essentials is “priced according to the size of your organisation, starting at £320 +VAT”. Plus is priced on the size and complexity of your network. Check IASME’s current tiers before you budget.

Free help first. The NCSC suggests using the free question set to “spot gaps, and take notes on the current setup”. The free Readiness Tool builds you an action plan. Many NCSC-assured Cyber Advisors offer SMEs a free 30-minute consultation.

Insurance. Eligible organisations can opt into the included cyber liability insurance. Eligibility includes certification covering the whole organisation, domicile in the UK or Crown Dependencies and annual turnover below £20m. IASME describes a £25,000 total limit of indemnity, with policy conditions and exclusions. Check IASME’s insurance information and your own cover needs; certification does not automatically put a suitable insurance policy in place for every business.

Plus, versions and renewal. Before Plus testing starts, the assessor must check that its scope matches your valid Cyber Essentials certificate (NCSC Plus test specification). v3.3 applies to assessment accounts created from 27 April 2026. Confirm which version applies to your assessment account with the certification body. Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months. Certification must be renewed annually; see the IASME FAQ.

Cyber Essentials in Northern Ireland

The NI Cyber Security Centre sends local organisations to the same NCSC scheme described above, and its guidance is written for organisations with up to 250 staff.

The UK government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found:

• 43% of UK businesses reported a cyber security breach or attack in the last 12 months. In Northern Ireland the figure was 33%. The survey warns that regional figures “will be influenced by other factors, such as the distribution of business sectors”, so treat the lower figure with care.
• 24% of businesses reported having technical controls in all five Cyber Essentials areas.
• Among small businesses, the share holding Cyber Essentials rose from 5% in 2024/2025 to 12% in 2025/2026.

If your business is hit by cyber crime, the NI Cyber Security Centre says to contact the PSNI.

Based in Derry, Blue Canvas works on AI adoption and workflows. Keep technical changes and certification decisions with the appropriate system owners and assessors.

A five-stage Cyber Essentials preparation plan

Use these stages to organise the work rather than promise a five-day completion time. The timetable depends on your systems, existing controls, access and any remediation needed. Several sites, servers or outsourced administration can make preparation more involved.

Get the official question set

IASME provides the current self-assessment questions as PDF and Excel downloads. Use the version appropriate to your assessment account and keep your preparation notes alongside it. The version for accounts created from 27 April 2026 is called Danzell.

The official question-set page also links to the requirements and explains the version changes. A download is preparation material, not an assessment submission or certificate.

For your own working record, add an owner, evidence location, status and review date for each action. Keep passwords and recovery codes out of the file, and restrict access to sensitive infrastructure details.

Discuss the AI side of your preparation

Planning AI or Copilot work alongside your security review? Book a free 15-minute call to discuss the project and what needs to be agreed with your IT provider. Please do not send passwords, recovery codes or sensitive business records.

For wider questions about backups, suppliers and evidence, see our cyber security audit guide. For everyday priorities, start with cyber security for small business. The DIY audit checklist is a practical companion to this certification-focused guide.

Book a free 15-minute call

Official sources are linked throughout. Check the current requirements and assessment questions before applying. Spotted an error? Email contact@bluecanvas.ai.

FAQ

What is on a Cyber Essentials checklist?

Scope comes first: which devices, accounts and cloud services you are certifying. Then the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The official list is the NCSC’s Requirements for IT Infrastructure, currently v3.3, and it takes precedence over this practical summary.

What changed in Cyber Essentials v3.3?

The NCSC lists six changes. v3.3 defines cloud services and states that they cannot be excluded from scope. It updates passwordless authentication to include FIDO2. It introduces the Software Security Code of Practice in the software development section, drops the reference to “untrusted connections” from the scope criteria and puts more weight on backing up data. It has applied since 27 April 2026.

How much does Cyber Essentials cost?

The NCSC says Cyber Essentials is priced according to the size of your organisation, starting at £320 plus VAT. Cyber Essentials Plus is priced on the size and complexity of your network. That is the certification fee. It is separate from any help you pay for to get ready. Confirm the current fee and what is included with IASME or your certification body before applying.

Can a small business do Cyber Essentials on its own?

Yes. The self-led route lets you register with IASME, pay and complete the self-assessment yourself. The free question set, the Readiness Tool and a free 30-minute call with an NCSC-assured Cyber Advisor all help. Outside help is most useful when your scope is complicated, for example when a supplier manages your systems or you run software you cannot update.

Does this checklist provide Cyber Essentials certification?

No. It helps you organise preparation and evidence. Certification is a separate assessment through IASME, the NCSC’s Cyber Essentials Delivery Partner, and its licensed certification bodies. Use IASME’s certificate search to check an organisation’s current certification.

Does Cyber Essentials apply to businesses in Northern Ireland?

Yes. It is a UK scheme, and the NI Cyber Security Centre points Northern Ireland organisations to it. Eligible UK or Crown Dependencies organisations with turnover below £20m and whole-organisation certification can opt into the included insurance, subject to its terms. Check eligibility and cover with IASME.