Cyber Essentials readiness checklist

We’ve decided whether we’re certifying the whole organisation or a clearly separated part of it (a "sub-set" split off by a firewall or VLAN). The whole organisation gives the best protection, and a partial scope has to be justified to the assessor.

We have a list of every laptop, desktop, tablet and phone used for work, including their operating system and version. A scope with no end-user devices isn’t acceptable.

We’ve included personal devices (BYOD) that access work email, files or apps. Phones used only for calls, texts or an MFA app are out of scope.

We’ve included home and remote workers’ devices. If we gave someone a router, that router is in scope too.

We’ve listed every server (physical, virtual or cloud-hosted).

We’ve listed every firewall and router, including the office broadband router.

We’ve listed every cloud service that holds or processes our data: Microsoft 365 or Google Workspace, accounting, CRM, file sharing, HR, booking systems, and business social media accounts. Cloud services can’t be left out of scope.

We know which accounts are used by outside suppliers or IT providers to manage our systems. Those accounts are in scope too.

Devices we lend to volunteers, trustees or contractors are included.

Every in-scope device is protected by a firewall: the office boundary firewall or router, and/or the software firewall built into Windows or macOS, switched on.

Laptops used at home, on public Wi-Fi or on the move have their software firewall switched on.

The default admin password on every router and firewall has been changed to a strong, unique one, or remote admin is switched off.

The router or firewall admin page can’t be reached from the internet. If it must be, there’s a documented business reason and it’s protected by MFA or an IP allow list.

Unauthenticated inbound connections are blocked by default.

Every inbound rule, such as a port forward, has been approved and documented by an authorised person, with the business reason written down.

Rules that are no longer needed have been removed. We’ve reviewed our firewall rules in the last 12 months.

Unused accounts are removed or disabled, including guest accounts and admin accounts no one uses.

Default or guessable passwords are changed on all devices and software.

Software nobody needs has been removed, including apps, utilities and network services.

Auto-run is switched off, so files and USB sticks can’t run anything without the user’s say-so.

Users must sign in before accessing any work data or services.

Every device has a screen lock: a password, PIN or biometric. A PIN or password used only to unlock the device is at least 6 characters.

Devices lock or slow down after repeated wrong guesses: no more than 10 attempts, or no more than 10 guesses in 5 minutes. Where you can’t configure this, the vendor’s default is used.

All software on in-scope devices is licensed and still supported by the vendor. Unsupported software in scope means a fail (for example, an old Windows version, or an app or router with no more security updates). Remove it, or move it into a separate network with no internet access.

Automatic updates are switched on wherever possible.

Automatic failHigh-risk or critical updates for operating systems and router/firewall firmware are installed within 14 days of release. (Danzell A6.4, an automatic fail.)

Automatic failHigh-risk or critical updates for applications, including their extensions and associated files, are installed within 14 days of release. (Danzell A6.5, an automatic fail.)

We treat an update as high-risk if the vendor calls it critical or high risk, if it fixes a vulnerability scored CVSS 7 or above, or if the vendor gives no details of what it fixes.

We can show dates: when an update came out and when it was installed.

There’s a process to create and approve new user accounts.

Everyone has their own login. No shared accounts for day-to-day work.

Leavers’ accounts are removed or disabled promptly, and inactive accounts after a set period.

Staff who need admin rights have a separate admin account, used only for admin tasks. No email or web browsing on it.

Admin rights are removed when someone changes role and no longer needs them.

Automatic failMFA is switched on for every administrator of every cloud service that offers it. (Danzell, an automatic fail.)

Automatic failMFA is switched on for every user of every cloud service that offers it, whether MFA is free, included or a paid add-on. (Danzell, an automatic fail.)

We’ve listed any cloud services that don’t offer MFA at all. The assessor will check that they really don’t.

Password-only logins are protected against guessing by MFA, throttling or lockout after no more than 10 attempts.

Passwords are long enough: at least 12 characters, or at least 8 characters with a block on common passwords, or protected by MFA. No maximum length. (Where MFA is used, the password part is at least 8 characters.)

We don’t force regular password changes or complexity rules. We encourage three random words and a password manager instead.

We have a quick process to change passwords when an account may be compromised.

Every in-scope device has active malware protection.

On Windows and Mac devices using anti-malware software (such as the built-in Microsoft Defender), it’s kept up to date, blocks malware from running and blocks connections to malicious websites.

Or, where used, application allow listing means only approved, code-signed apps can run, there’s a current list of approved apps, and users can’t install unsigned apps.

Phones and tablets only install apps from the official app store, and the store’s protection is left on.

Important data is backed up automatically, to cloud storage or another device.

Any USB or external backup drive is disconnected when a backup isn’t running.

We’ve actually tested a restore recently.