The Cyber Essentials checklist

The checklist in one screen

Cyber Essentials tests five technical controls. If every line below is true for every device and account in scope, you will pass. If any line is false, that is the work to do before you submit — and the two marked auto-fail will fail the whole assessment on their own.

1. Firewalls and internet gateways

• Every internet connection sits behind a firewall — the router's built-in one counts, as does the software firewall on a laptop used on public Wi-Fi.
• Default admin passwords on routers and firewalls have been changed.
• No inbound services are open to the internet unless there is a documented business need.
• Remote administration of the firewall is disabled or protected by MFA.

2. Secure configuration

• Unused software, accounts and services have been removed or disabled on every device.
• Default passwords on every device and application have been changed.
• Auto-run of removable media is off.
• Devices lock after inactivity, and unlocking needs a password, PIN or biometric.

3. Security update management

• Auto-fail: nothing in scope runs an operating system or application that is out of vendor support. Windows 10 is the one that catches people.
• High-risk and critical updates are applied within 14 days of release.
• Automatic updates are switched on wherever the software allows.
• Software is licensed and supported — no abandoned browsers or old office suites.

4. User access control

• Every user has their own account; no shared logins.
• Admin accounts are separate from day-to-day accounts and used only for admin tasks.
• Accounts are created through a documented process and removed when people leave.
• Auto-fail: multi-factor authentication is on for every cloud service that offers it. The MFA rules in full.
• Passwords meet the scheme's minimum — a password manager and a 12-character minimum is the simplest compliant setup.

5. Malware protection

• Every in-scope device has anti-malware software that updates automatically and scans files on access, or only runs approved applications (allow-listing), or runs apps only in a sandbox.
• Phones and tablets only install apps from the official store, and the device is not jailbroken or rooted.

Before the five controls: get the scope right

Most failures aren't a control — they're a device nobody counted. Home-working laptops, the director's personal phone with work email on it, the tablet on the shop floor, the server in the cupboard: if it touches business data or the business network, it is in scope and every line above applies to it. Personal devices are the usual surprise.

What the questionnaire will ask you for

The self-assessment is around 70 questions, answered by someone who can sign on behalf of the business. You'll need: a count of devices by operating system and version, a count of servers and what they run, a list of your cloud services and whether MFA is on for each, the name of your anti-malware product, and confirmation of who holds admin rights. Gather those before you open the portal and the questionnaire takes an afternoon rather than a fortnight. There's a fuller walk-through in how to answer the questionnaire.

How long the whole thing takes

If the checklist is already true: a week. If you have an unsupported machine to replace or MFA to roll out: four to six weeks, most of it waiting for the fixes. Certification bodies typically return a result within a few working days of submission, and you get one free resubmission if something is marked as needing more information.