How to pass Cyber Essentials: a checklist for each control

Cyber Essentials is a UK government-backed certification built on five technical controls. They’re the same for every organisation, whatever its size or sector.

• Firewalls. Every device in scope sits behind a firewall, including devices used away from the office.
• Secure configuration.Default passwords and settings get changed. Software and accounts you don’t need are removed or switched off.
• Security update management. Only supported software is in use. High and critical updates go on within 14 days of release.
• User access control. People only get the access they need, and admin accounts are kept separate. MFA is on for every cloud service that offers it.
• Malware protection. Every device in scope is protected, either with anti-malware software or by only letting approved apps run.

For Cyber Essentials you answer a self-assessment questionnaire, and an IASME-accredited Certification Body marks it and issues the certificate. Cyber Essentials Plus uses the same controls and adds an independent technical audit.

Scope is the set of networks, devices, software and cloud services the certificate covers. You can certify the whole organisation or a separately managed sub-set, segregated from the rest by a firewall or VLAN.

You agree the scope with your certification body before the assessment begins. If you leave part of the organisation out, you’ll need to explain which part and why.

A device counts if it can make or accept connections over the internet, or if it controls traffic between those devices and the internet. These always have to be in scope:

• ✓End-user devices. A scope without laptops, desktops, tablets or phones isn’t acceptable.
• ✓Every cloud service that holds or processes your data. Cloud services can’t be excluded.
• ✓Personal devices that staff or volunteers use to reach your data or services, apart from phones used only for their built-in calling and messaging apps or an MFA app.
• ✓Home working devices. A router you’ve given a home worker is in scope too, and devices on any other home router need a software firewall, unless they connect through a corporate VPN.
• ✓Accounts your IT provider or other suppliers use to manage your systems.
• ✓Devices you own that you’ve lent to someone outside the organisation.

Under the Danzell question set you also list every legal entity the certificate covers. You can ask for a separate certificate for each one.

Every device in scope needs a correctly configured firewall, either a boundary firewall on your network or a software firewall on the device. Use a software firewall wherever you don’t control the network a device connects to.

• ✓Default admin passwords on firewalls and routers are changed to strong, unique ones, or remote admin is switched off
• ✓The admin interface can’t be reached from the internet, unless there’s a documented business need and it’s protected by MFA, or by an IP allow list plus a well-managed password
• ✓Unauthenticated inbound connections are blocked by default
• ✓Every inbound rule is approved by an authorised person and documented with the business reason
• ✓Rules you no longer need are removed or disabled
• ✓Laptops used on public wifi have their software firewall switched on

Out of the box, devices often come with default passwords and extras nobody needs, such as spare accounts and software. This control removes those weak points before an attacker finds them.

• ✓Accounts nobody uses are removed or disabled, including guest accounts and spare admin accounts
• ✓Default and guessable passwords are changed
• ✓Software you don’t need is removed or disabled, down to system utilities and network services
• ✓Auto-run is off, so files can’t run without the user’s say-so
• ✓People sign in before they can reach your data or services
• ✓Every device asks for a credential, such as a PIN or a fingerprint, before anyone can use it
• ✓Device sign-in is protected against guessing where the device allows it: no more than 10 attempts in five minutes, or a lockout after 10 failed attempts. Otherwise the vendor's default applies
• ✓A PIN or password used only to unlock the device is at least six characters long. If it also signs you in to your data or services, the full password rules apply

Attackers move quickly once a vulnerability is public. This control makes sure the fixes vendors release get installed in time.

• ✓All software is licensed and still supported by its vendor
• ✓Unsupported software is removed, or moved into a sub-set with no internet access
• ✓Automatic updates are on wherever they’re available
• ✓Updates the vendor rates critical or high risk go on within 14 days of release, and so do fixes with a CVSS v3 score of 7 or more
• ✓Updates that come with no severity rating are treated the same way
• ✓An update that bundles several fixes goes on within 14 days if any of them is critical or high risk
• ✓Router and firewall firmware is kept to the same 14 days

Under Danzell, a critical or high-risk update that isn’t installed within 14 days fails the assessment on its own. It applies to firmware as well as software.

Every account is a way in, and admin accounts are worth the most to an attacker. This control keeps each account in the right hands, with no more access than the job needs.

• ✓There’s a process for creating and approving user accounts
• ✓Everyone signs in with their own unique credentials
• ✓Accounts are removed or disabled when someone leaves, or after a set period without use
• ✓MFA is on for every cloud service, and anywhere else it’s available
• ✓Admins use a separate account for admin work only, never for email or browsing
• ✓Admin rights are removed when someone no longer needs them, such as after a change of role
• ✓Accounts your IT provider or other suppliers use follow the same rules
• ✓Without MFA, passwords are at least 12 characters, or at least 8 if common passwords are blocked automatically. There’s no maximum length either way.
• ✓With MFA, the password part is at least 8 characters, with no maximum length.

FIDO2 authenticators, a kind of passkey, count as MFA, and v3.3 adds FIDO2 to its definition of passwordless sign-in. SMS codes count too, though the NCSC suggests another method if one will work for you.

Every device in scope needs an active malware protection mechanism. For each device, you can use anti-malware software or application allow listing.

• ✓Malware protection is active on every device in scope, and kept up to date as the vendor recommends
• ✓Anti-malware software (an option on Windows and macOS devices) stops malware and malicious code from running
• ✓It also blocks connections to malicious websites
• ✓With allow listing, only approved apps restricted by code signing can run
• ✓You approve apps before they’re deployed, and keep the list of approved apps current
• ✓Users can’t install anything unsigned or with an invalid signature

Three things fail an assessment on their own. Under the Danzell question set, the first two are a cloud service that offers MFA without it switched on, and a high or critical security update that isn’t installed within 14 days of release.

The third is unsupported software anywhere in scope. Remove it or move it to a sub-set with no internet access, since everything in scope has to be supported on the day the certificate’s issued. Check all three before you submit anything.

Check your setup against each checklist and write down every gap. Put the automatic fails at the top, then work through the rest control by control.

For each gap, note the control it falls under and who owns the fix. A few examples:

Most of the time goes on pulling the answers together, especially from a scattered IT estate.

• ✓A current list of the devices in scope and the software on them
• ✓Every cloud service you use, and whether MFA is on for each one
• ✓Your firewall rules, with who approved each inbound rule and why
• ✓Who has admin rights, and the separate accounts they use for admin work
• ✓The legal entities the certificate should cover, and any parts of the network you’re leaving out

Your certification body may ask for evidence before it awards the certificate. Keep it somewhere you can find it again at renewal.

1. 1.

   Agree the scope

   Decide whether the certificate covers the whole organisation or a separately managed sub-set. The NCSC’s rules say you agree it with your certification body before the assessment begins.

2. 2.

   Apply through your certification body

   You’re sent login details for IASME’s assessment portal. IASME gives you six months from applying to submit, and after that the account can be closed.

3. 3.

   Answer the questions

   Work through the Danzell questions in the portal, saving as you go. A board member or equivalent then signs a declaration that the answers are true.

4. 4.

   The assessor marks your answers

   An assessor at your certification body marks each answer and may ask for more information on any of them. You get feedback on anything that isn’t fully compliant.

5. 5.

   Get the certificate

   Once you pass, your certificate is issued. Your organisation also shows on IASME’s certificate search, which lists certificates issued in the last 12 months.

6. 6.

   Renew every 12 months

   The certificate expires after 12 months. To renew, you answer every question again against whichever question set is current.

The assessment runs online, so we can certify you anywhere in the UK: see how our Cyber Essentials certification works.

Plus checks the same five controls, then adds an independent technical audit of a sample of your devices. You need Cyber Essentials first.

Under Danzell, a retest includes a new sample of devices. That stops an organisation fixing only the devices tested the first time.

We get organisations ready for the Plus audit. The audit itself is carried out independently, not by us. The control work is the same, so what you do for Cyber Essentials carries straight into Plus.

Renewal is a fresh assessment against whichever question set is current at the time. IASME and the NCSC review the requirements every year, so check what’s changed before you start.

The current release is the Danzell question set with Requirements for IT Infrastructure v3.3, for assessment accounts created from late April 2026. Our post on what changed in v3.3 covers the differences.

If you supply the MOD, Cyber Essentials is also the first control in Defence Cyber Certification Level 0. The two scopes have to match.

The NCSC publishes the rules in Cyber Essentials: Requirements for IT Infrastructure v3.3 (PDF, opens in a new tab), dated April 2026. The checklists on this page follow it.

Backups aren’t one of the technical requirements. The document still recommends them strongly, because they help you recover faster if data is lost or stolen.