Cyber Essentials: Five Protections
Cyber Essentials (CE) and Cyber Essentials Plus (CE+) check the same five protections. Use these checks with the full requirements and the question set for your assessment account.
Start with the Boundary
Apply the device, cloud and third-party rules before checking controls. A department label or an unsupported app is not a valid exclusion by itself. Agree the boundary and any exceptions with the certification body.
Firewalls
A firewall filters connections between your systems and the internet. Check the network, devices and cloud settings that provide this protection.
- Cover Every In-scope Device
- Protect every in-scope device with a correctly configured firewall. This can be a network firewall where your organisation controls the network. On networks you do not control, use the device’s software firewall.
- Review the Rules
- Block unauthenticated inbound connections by default. Authorise and document necessary inbound rules and their business need; remove unneeded rules.
- Protect Management Access
- Change default admin passwords to strong, unique passwords, or disable remote administration entirely. Keep internet-facing management off unless there is a documented business need; then use multi-factor authentication (MFA), an extra sign-in check, or a small trusted-address list with properly managed passwords.
Useful Evidence
- Firewall rules with approvals and business reasons.
- Endpoint settings showing active device firewalls, including remote work.
A network firewall does not protect a laptop away from that network. Organisation-supplied home routers are included; other home routers are excluded. Device firewall requirements still apply.
Secure Configuration
Remove unsafe settings, unused accounts and software that the device or service does not need.
- Remove Unused Access
- Disable unnecessary accounts and change default or guessable passwords.
- Reduce What Is Running
- Remove unneeded apps, utilities and services; disable unauthorised autorun.
- Lock and Protect Devices
- Prevent repeated unlock guesses. For device-only unlocking, a password or PIN needs at least six characters. If it also signs into services, the full account-password rules apply.
Useful Evidence
- A current device setup standard and checked device or cloud settings.
- An account and software review showing what was removed or corrected.
Assuming factory settings are secure.
Security Updates
The scheme calls this security update management: keep supported software current and fix known weaknesses.
- Use Supported Software
- Keep software licensed and supported. Remove or replace unsupported software. Any proposed isolated network area must meet the scope rules and be agreed with the certification body; simply blocking an app is insufficient.
- Automate Where Possible
- Enable automatic updates where possible for in-scope software and services.
- Meet the 14-Day Rule
- Install fixes within 14 days of release if the vendor rates them high/critical, their CVSS v3 severity score is at least 7, or no severity is published. CVSS is a standard vulnerability severity score from 0 to 10; ask the vendor or your IT provider for the v3 base score. A bundle containing any qualifying fix also counts.
Useful Evidence
- Software support dates, update settings and vendor notices.
- Update records showing release/fix dates, severity basis and open exceptions.
Count from release, not discovery. Applying all other updates within 14 days is recommended, rather than a separate mandatory rule.
User Access Control
Give people only the access they need. Administrator accounts can change systems, so keep them separate from everyday work.
- Manage Accounts
- Approve accounts, use unique credentials and disable unneeded accounts, including provider accounts.
- Limit Privilege
- Grant role-based access. Use separate admin-only accounts, not for email or browsing; remove unneeded privilege.
- Protect Sign-In
- Use multi-factor authentication (MFA), an additional sign-in check, for every cloud user and administrator wherever available. Check both the service’s own MFA and options to sign in through another service. If no MFA option exists, record the service and confirm its treatment with your certification body. Available MFA must be enabled. Where MFA uses a password, it needs at least eight characters; check the full password/passwordless rules.
Useful Evidence
- Account approval/removal records and a recent access review.
- Cloud MFA settings and evidence of separate admin accounts, including provider accounts.
One MFA screenshot does not prove every cloud account is covered. Ask the provider about linked sign-in services and separate administrator access.
Malware Protection
Stop malicious software from running. Check that the approved protection method works on every device platform in scope.
- Choose an Accepted Method
- Use anti-malware software on Windows/macOS, including servers, or restrict devices to approved apps with valid digital signatures. Check the method allowed for each platform.
- Keep Protection Active
- Follow vendor updates and settings. Anti-malware must block malicious software and websites; an approved-app approach must block unsigned or invalidly signed apps.
Useful Evidence
- Settings showing which protection method is active on each platform.
- For approved-app restrictions, the current approved list and how unapproved apps are blocked.
Assuming a product name proves platform coverage and active settings.
Backups Help You Recover
Backups are recommended good practice, rather than a sixth mandatory Cyber Essentials control. Consider automatic backups and disconnect removable backup media when it is not in use.
Make Each Check Answerable
Link each answer to scope, owner and current evidence.
- Confirm Applicability
- Map devices, software, services and administrators to scope; identify the applicant/provider responsible.
- Show Operation
- Use current settings, logs, update records or reviews. A policy, completed task or single scan cannot prove every requirement.
- Record Gaps
- Name the owner, action and review date. Keep client evidence in approved systems.
Fictional Example: an Update with No Severity
An organisation cannot confirm when its provider applied a software update. The vendor published no severity rating.
- Next Action
- The person responsible for IT checks the vendor’s release date and asks the provider for installation evidence. They record an action if the required 14-day deadline was missed.
- What This Settles
- Missing severity is treated as a qualifying update. The answer is based on dates and evidence, rather than an assumption.