Firewalls
Every in-scope device needs a properly configured firewall between it and the internet, whether that is a boundary firewall or a software firewall on the device. Default admin passwords must be changed, remote administration interfaces should not be exposed to the internet unless protected (for example with MFA or an IP allow-list), and unnecessary inbound rules removed. Business-grade options include Cisco Secure Firewall and Sophos Firewall.
Secure configuration
Remove or disable software and accounts you do not need, change default passwords, turn off auto-run, and make sure devices lock and require authentication. Password policy must defend against guessing, through MFA, throttling or lockout, and a minimum length.
Security update management
Software must be licensed and supported. High-risk or critical updates, including those the vendor rates as critical or high, must be applied within 14 days of release. Unsupported software must be removed from scope.
User access control
Give accounts only the access they need, use separate admin accounts for admin tasks, remove leavers promptly, and enforce multi-factor authentication on cloud services wherever it is available. Cisco Duo is a common way to add MFA to systems that lack it.
Malware protection
Protect devices with anti-malware software, application allow-listing, or the built-in protections of the platform where they meet the requirement. Keep it updated and configured to scan web pages and block malicious sites.
Scope rules worth knowing
Cloud services you use, such as Microsoft 365, are in scope. Home workers' devices that access organisational data are in scope, but home routers are generally not, which puts the firewall burden on the device itself. For the hands-on test version see Cyber Essentials Plus requirements.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers, and patches that sit for weeks. We find those gaps before an assessor does.
- Readiness review of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider; we prepare you for certification and work alongside a licensed certification body, which issues the certificate.
Want to know how close you are to passing?
Talk to Forever Systems on 0333 358 3808 or send us an enquiry and we will come back to you with options, not a hard sell.
Call 0333 358 3808Send an enquiryFrequently asked questions
How often do the Cyber Essentials requirements change?
The requirements and question set are reviewed periodically, usually with an annual update. Always check you are working to the current version before you apply.
Does Cyber Essentials require MFA?
Yes, multi-factor authentication must be used for cloud services wherever the service offers it, for both users and administrators.
Is Windows 10 allowed for Cyber Essentials?
Only if it is still receiving security updates under a valid support arrangement. Devices running any operating system that is out of support must be upgraded, replaced or taken out of scope.