Cyber Essentials: what you actually need to pass

Cyber Essentials is the UK government-backed baseline for organisational cyber security. It is deliberately not exotic: the five controls target the techniques behind most everyday attacks. What makes it hard is that it applies to everything in scope, and the questions expect precise answers.

Step one: work out the scope

Scope is where most surprises come from. In general, anything that accesses your organisation’s data or services is in scope. That includes:

• Every company laptop, desktop, server, firewall and router.
• Cloud services such as Microsoft 365 and any other software you sign in to.
• Personal devices used for work, including phones that receive work email.
• Home workers’ devices. Their home router is generally out of scope if the device’s own firewall is doing the job, but the device itself is in.

You can certify part of an organisation, but the boundary has to be a real network separation, not just a list of the devices you would prefer to include.

The five controls

1. Firewalls

Every device needs a firewall between it and the internet, configured properly. Default admin passwords changed, unnecessary inbound rules removed, and any rule you keep has a documented reason.

2. Secure configuration

Remove or disable what you don’t need: default accounts, unused software, auto-run. Enforce a screen lock or sign-in on every device. Shared generic logins are a problem here.

3. Security update management

Everything in scope must be supported by its vendor and receiving updates. High and critical security updates must be applied within 14 days of release. This applies to operating systems, applications and firmware, including routers and firewalls. A single unsupported operating system anywhere in scope is enough to fail.

4. User access control

Everyone has their own account. Admin rights only go to people who need them, through separate admin accounts used only for admin tasks. Leavers are removed promptly. And multi-factor authentication must be on for every cloud service that supports it. Missing MFA on a cloud service is now an automatic fail.

5. Malware protection

Every in-scope device needs protection that is active and kept up to date, or an approved alternative such as application allow-listing.

The most common reasons businesses fail

1. One old PC or laptop running an unsupported version of Windows.
2. MFA missing on a cloud service, often a secondary one nobody thought about.
3. Staff working as local administrators day to day.
4. Router or firewall firmware that has never been updated.
5. Personal phones with work email and no screen lock.
6. Accounts belonging to people who left.

Every one of these is fixable. The issue is usually time, which is why we run a gap assessment before anything is submitted.

How long does it take?

From a standing start, basic Cyber Essentials typically takes three to six weeks, most of it spent fixing gaps rather than filling in forms. If your IT is already well managed, it can be much faster. Cyber Essentials Plus, which adds hands-on testing by an assessor, typically takes six to ten weeks and requires the basic certificate first.

Staying certified

Certification lasts twelve months, but it describes how things were on the day. The useful version of Cyber Essentials is one where the controls simply become how your IT is run, so renewal is a formality. That is how we approach it for clients on our Cyber Essentials service.

Quick answers