Cyber Essentials Requirements: A Practical Checklist

• Change default administrative passwords to strong, unique passwords, or disable remote administrative access altogether.
• Block unauthenticated inbound connections by default and keep firewall administration off the public internet unless there is a documented business need with suitable protection.
• Approve and document inbound rules, including the business need, and regularly review them.
• Remove or disable unnecessary firewall rules when they are no longer needed; use a software firewall on devices connecting to untrusted networks such as public Wi-Fi.

Treat firewall rules and credentials as a maintained control, not a one-time setup task.

• Change default passwords and settings, and control and regularly review configurations against an agreed baseline.
• Remove or disable unnecessary user accounts, software, services, and functionality, including features that are not needed for the role.
• Use supported security settings for operating systems, applications, routers, firewalls, mobile devices, and cloud services.
• Record meaningful configuration changes so that an unexpected setting can be investigated and corrected.

A configuration review should cover the systems and services in scope, not only the office network.

• Keep operating systems, applications, routers, firewalls, and firmware licensed and supported by a vendor that provides vulnerability fixes.
• Remove end-of-life or unsupported software from devices, or place it in a defined, isolated sub-set that prevents all traffic to or from the internet.
• Enable automatic updates where possible and apply vulnerability fixes within 14 days of release when the vendor calls them critical or high risk, the CVSS v3 base score is 7 or above, or the vendor gives no severity details.
• Track exceptions and update evidence so that urgent fixes are not missed when an update covers several issues.

The official 14-day requirement applies to those update classes. Applying every update within 14 days is strongly recommended for optimum security, but is not the blanket mandatory rule. An unmet mandatory requirement should be treated as a certification blocker; confirm the current assessment question and outcome with your Certification Body rather than inventing an automatic-fail rule.

• Create and approve individual user accounts, authenticate users with unique credentials, and remove or disable accounts when someone leaves or an account is no longer required.
• Review access when someone changes role and give users only the applications, devices, and services needed for their work.
• Use least privilege, keep administrator controls limited, and use separate administrator accounts for administrative activity where appropriate.
• Implement MFA where it is available; authentication to cloud services must always use MFA. Passwordless options such as passkeys and FIDO2 authenticators can provide a passwordless authentication method, with FIDO2 treated as MFA in the v3.3 guidance.

Include third-party support accounts in the review and keep an auditable joiner, mover, and leaver process.

• Keep a malware protection mechanism active on every device in scope and keep it up to date in line with the vendor instructions.
• Use anti-malware protection configured to prevent malware from running, prevent malicious code execution, and prevent connections to malicious websites where supported.
• Alternatively, use application allowlisting with code-signing controls, active approval, and a current list of approved applications.
• Review whether protection applies across servers, desktops, laptops, tablets, mobile phones, and relevant cloud service models in scope.

Antivirus alone does not guarantee compliance: the mechanism must be active, current, and configured to meet the applicable protection requirements.