Devices and software
- You have a list of every laptop, desktop, server, tablet and phone that accesses work data
- Every operating system and application is still supported and receiving security updates
- Automatic updates are on, and critical or high-risk updates are applied within 14 days
- Software you do not need has been removed
Accounts and passwords
- Every user has their own account; no shared logins
- Admin accounts are separate and used only for admin tasks
- Leavers' accounts are disabled promptly
- MFA is enabled on Microsoft 365, Google Workspace and every other cloud service that offers it
- Default passwords on routers, firewalls and other kit have been changed
Firewalls and networks
- Your office router or firewall has a strong, unique admin password
- Remote admin of the firewall is off, or protected with MFA or an IP allow-list
- Inbound ports are closed unless there is a documented business need
- Software firewalls are on for laptops used at home or on public Wi-Fi
Malware protection
- Anti-malware is installed, updated and active on every in-scope device
- Web filtering blocks known malicious sites, for example with Cisco Umbrella
- Staff know how to spot phishing; see security awareness training
If several of these are uncertain, start with our requirements guide or let us run a readiness review.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers, and patches that sit for weeks. We find those gaps before an assessor does.
- Readiness review of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider; we prepare you for certification and work alongside a licensed certification body, which issues the certificate.
Want to know how close you are to passing?
Talk to Forever Systems on 0333 358 3808 or send us an enquiry and we will come back to you with options, not a hard sell.
Call 0333 358 3808Send an enquiryFrequently asked questions
Is there an official Cyber Essentials checklist?
The official reference is the current requirements document and question set published for the scheme. This checklist is our practical summary of the points that most often trip people up.
What is a Cyber Essentials checker?
People often mean a readiness tool or a lookup of whether a company holds a certificate. For readiness, this checklist and a review by us is a sensible first step.