Cyber Essentials Readiness Checklist

0. Scope

The organisation (or sub-set) being certified is clearly defined.
All end-user devices (laptops, desktops, tablets, phones) in scope are listed, including home workers' devices.
All cloud services (e.g. Microsoft 365, Google Workspace, hosting, SaaS) are listed.
Bring-your-own devices used to access organisational data or services are identified.

1. Firewalls

Every device is protected by a correctly configured firewall (boundary and/or software firewall).
Default administrative passwords on firewalls and routers have been changed.
Unauthenticated inbound connections are blocked by default.
Any open inbound rules are documented, approved and removed when no longer needed.
Firewall admin interfaces are not accessible from the internet unless protected by MFA or an IP allow-list.

2. Secure configuration

Unnecessary software, services and user accounts are removed or disabled.
Default and guessable passwords are changed on all devices and software.
Auto-run is disabled for removable media and downloaded content.
Devices require a PIN, password or biometric to unlock, with brute-force protection.

3. Security update management

All software in scope is licensed and supported by the vendor.
High and critical security updates are applied within 14 days of release.
Automatic updates are enabled wherever possible.
Unsupported software and operating systems are removed or isolated from scope.

4. User access control

Every user has their own account; shared accounts are avoided.
Users have only the access they need for their role (least privilege).
Administrators use separate admin accounts only for admin tasks, not email or web browsing.
Multi-factor authentication is enabled on all cloud services, especially for administrators.
Accounts are removed or disabled promptly when people leave or change role.
A password policy is in place (e.g. minimum length, no common passwords, password managers encouraged).

5. Malware protection

Anti-malware software is installed and active on all applicable devices, or application allow-listing is used.
Anti-malware is kept up to date and scans files automatically.
Access to known malicious websites is blocked where supported.

This checklist is a readiness aid and does not replace the official Cyber Essentials requirements. Always check the current requirements published by NCSC and IASME before applying. © 2026 McArthur Infosec.