Cyber Essentials is “the minimum standard of cyber security recommended by the Government for organisations of all sizes” (NCSC). It is a verified self-assessment: you answer a questionnaire about your own systems, and a certification body licensed by IASME checks the answers and awards the certificate. Cyber Essentials Plus covers the same five controls and adds a hands-on test by an assessor.
The checklist below follows the NCSC’s requirements for IT infrastructure, version 3.3, which apply to every assessment started on or after 27 April 2026 (NCSC, Requirements for IT infrastructure v3.3). Answer each question honestly for every computer, phone, server, router, firewall and cloud service the business uses. A “no” is a gap to close before you apply, and two of the questions fail an assessment on their own.
Before the controls: what is in scope
- Do you have a list of every cloud service the business uses, including the small ones such as accounting, payroll, HR, the CRM, supplier portals and the domain registrar? Every cloud service that holds or processes your data is in scope and cannot be left out.
- Do staff read work email or files on their own phones or laptops? If so, those devices are in scope too and need the same controls as company devices, apart from phones used only for calls, texts and authentication apps.
- Do your IT supplier’s or contractors’ accounts on your systems follow the same rules as your staff’s? Accounts you own are in scope even when a supplier uses them.
1. Firewalls
- Is there a firewall between your office network and the internet, either a firewall or a router with its firewall switched on?
- Is the built-in firewall switched on for every laptop, so it is protected at home and on public wifi? A device used on a network you do not control needs its own software firewall.
- Has the default admin password on every router and firewall been changed to a strong, unique one, or remote admin turned off?
- Is each router’s and firewall’s admin page closed to the internet, or protected by multi-factor authentication or limited to a few trusted addresses?
- Is every rule that lets traffic in from the internet approved, written down with its reason, and removed when no longer needed?
The router the internet provider sent, which nobody has logged into for years, is the usual gap here.
2. Secure configuration
- Are unused accounts, such as guest accounts, old staff accounts and spare admin accounts, removed or disabled on computers and devices?
- Is software nobody needs removed, and are downloaded files stopped from running automatically without the user’s say-so?
- Does every computer, tablet and phone need a PIN, password or fingerprint to unlock, with a PIN or password of at least six characters, and does it lock or slow down after repeated wrong attempts? The requirement allows no more than 10 guesses.
3. Security updates
- Is every operating system and application still supported by its maker and receiving security updates? Windows 10 stopped receiving free security updates in October 2025. Unsupported software has to go, or the device has to be cut off from the internet on a separate network.
- Is all your software properly licensed?
- Are automatic updates switched on wherever they are available?
- Are critical and high-risk updates installed within 14 days of release on everything: computers, phones, servers, routers, firewalls and applications? Missing this anywhere is an automatic fail.
4. User access control
- Does everyone have their own login, with no shared accounts?
- Is there a set way to create and approve new accounts, and are leavers’ accounts removed or disabled promptly?
- Do people with admin rights use a separate admin account only for admin work, and a normal account for email and the web?
- Is multi-factor authentication switched on for every user on every cloud service that offers it? Not just administrators, and not just Microsoft 365: the accounting package, the HR system and the supplier portal count. Missing it is an automatic fail.
- Where multi-factor authentication is not used, do passwords have to be at least 12 characters, or at least 8 with common passwords blocked, and is guessing slowed down or locked out? These have to be enforced by settings, not left to users.
5. Malware protection
- Does every Windows and Mac computer, servers included, have malware protection that is switched on, kept up to date and blocks known malicious websites?
- Can phones and tablets install apps only from an approved store or list? A device without anti-malware needs application allow-listing, so only approved, signed apps can run.
The two that fail on their own
Most of the questions add up to a picture of how well the business is run. Two do not: a “no” to either fails the assessment outright, whatever else is in place.
The first is multi-factor authentication on every cloud service that offers it, for every user. The second is critical and high-risk updates applied within 14 days everywhere, including the routers, firewalls and applications that are not covered by Windows Update. Both became strict in April 2026, and both are where businesses that thought they were ready get caught.
What changed in April 2026
The five controls did not change. The questions got stricter. Cloud services can no longer be left out of scope, multi-factor authentication is required wherever a service offers it, and the 14-day patching window applies to every device and application in scope. For Cyber Essentials Plus, you can no longer change your self-assessment answers based on what the assessor finds, and a second failure revokes the certificate. Our article on the Cyber Essentials changes from April 2026 goes through them in detail.
Who awards the certificate, and how long it takes
The certificate is awarded by an IASME-licensed certification body on the strength of your self-assessment. We are not a certification body or an assessor: we check where you stand, put the missing controls in place where you ask us to, and prepare the questionnaire and its evidence with you. From the gap analysis to the certificate usually takes two to four weeks, depending on how many gaps the analysis finds. The hands-on test for Plus is carried out by a licensed assessor and charged by the certification body.
Where to start
Work through the list above with the people who look after your IT, and write down every “no”. If you would rather have the answers in a few minutes, our Cyber Essentials check asks the same questions and gives you the result straight away, with no name or email needed.
When a customer or a contract has set the deadline, read what to do first when you are asked for Cyber Essentials, or ask us about our Cyber Essentials consultancy. We prepare businesses for it across the North East, including Stockton, Middlesbrough, Newcastle and Durham, and the service desk answers within three rings on 01642 661888.