In short: Cyber Essentials secure configuration means removing unnecessary accounts and software, changing default or guessable passwords, disabling auto-run, authenticating users before access and locking devices. Unlock credentials must resist guessing, with no more than 10 attempts in 5 minutes or lockout after 10, and unlock-only PINs or passwords need at least 6 characters.
Why default settings are a risk
New computers, phones, network devices and cloud tenants often arrive with weak points already built in: an admin account with a publicly known password or no MFA, extra user accounts nobody needs (sometimes with high privileges), and pre-installed applications and services that widen the attack surface. Attackers know these defaults and scan for them.
The Secure Configuration control applies to servers, desktops, laptops, tablets, phones and thin clients, and to cloud services at the infrastructure, platform and software levels. It expects you to manage configuration actively and regularly, not just once at set-up.
The secure configuration requirements
On a regular basis you must:
- Remove or disable user accounts you do not need, such as guest accounts and admin accounts that will not be used
- Change any default or easily guessed password (see our password requirements)
- Remove or disable software you do not need, including applications, system utilities and network services
- Turn off any auto-run feature that lets files execute without the user's say-so, for example when removable media is inserted or a file is downloaded
- Authenticate users before they can reach organisational data or services
- Apply suitable device locking for users who are physically present
These sound basic, and they are. They are also where many self-assessments come unstuck, because nobody has looked at what is actually installed on each device for years.
Device locking: credentials and brute-force protection
Where using a device requires someone to be physically present, such as signing in to a laptop or unlocking a phone, a biometric, password or PIN must be in place first. That credential must be protected against repeated guessing, and its quality must be enforced by a technical control.
| Requirement | What satisfies it |
|---|---|
| Credential before access | Biometric (fingerprint or face), password or PIN |
| Brute-force protection | Throttling that allows no more than 10 guesses in 5 minutes, or locking the device after no more than 10 failed attempts |
| Vendor does not allow these settings | Use the vendor's default protection |
| Credential only unlocks the device | Minimum length of 6 characters for the password or PIN |
| Credential also used to sign in to services | Full password-based authentication rules apply (see User Access Control) |
Most current phones and tablets already slow down repeated guesses by default, so the main job is setting a 6-digit minimum and making sure no device has locking switched off.
Secure configuration in the cloud
The control applies to cloud services as well as physical kit, and the responsibility is usually shared. For software as a service such as Microsoft 365 or Google Workspace, both you and the provider play a part: the provider secures the platform, but you must configure your tenant securely.
Typical tenant tasks include removing old and unused accounts, reviewing guest access, turning off services and third-party app connections you do not use, and checking that built-in administrator accounts are protected by MFA. Our cloud services and Cyber Essentials page explains the shared responsibility model, and a Microsoft 365 security assessment is a quick way to see where your tenant stands.
Enforcing it at scale with device management
Configuring devices by hand works for a handful of laptops; beyond that, settings drift. Mobile device management (MDM) lets you define a baseline once and apply it everywhere. With Microsoft Intune, for example, you can set PIN length and lock behaviour, require a screen lock after inactivity, disable AutoPlay, remove unwanted apps and report on any device that falls out of line. Group Policy does a similar job for Windows devices joined to an on-premises domain.
Device management also gives you something most small organisations lack: a reliable, current list of every device and what runs on it. That list is the foundation for the security update management control too.
Common secure configuration gaps
These are the issues we find most often during readiness reviews:
- A local administrator account on every PC with the same password, or one that has never been changed
- Old software left on machines (trial antivirus, unused utilities, old browser plug-ins and runtimes)
- Shared or default credentials on printers, NAS boxes and Wi-Fi access points that are reachable from the internet
- Phones with no lock, or a 4-digit PIN
- Guest and former-employee accounts still active in the cloud tenant
- Auto-run of removable media still enabled on older Windows builds
Anything unsupported should not be reconfigured but removed or replaced; see security update management.
How we help
We audit device and tenant configuration against v3.3, build a secure baseline in Microsoft Intune or your existing tooling, remove unnecessary software and accounts, and give you reports you can rely on when answering the question set. For a full picture of where you stand, start with a Cyber Essentials gap analysis.
Contact us to discuss your devices, or go back to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is secure configuration in Cyber Essentials?
It is the control that makes sure devices and cloud services run only what they need. You remove unnecessary accounts and software, change default passwords, disable auto-run, authenticate users before access and make sure devices lock.
What PIN length does Cyber Essentials require?
If a PIN or password is only used to unlock a device, it must be at least 6 characters. If the same credential is also used to sign in to services, the full password rules apply instead.
Do fingerprint and face unlock count for Cyber Essentials?
Yes. A biometric is one of the accepted ways to control access to a device, alongside a password or PIN, as long as it is protected against repeated guessing.
How many failed attempts are allowed before lockout?
Either throttle attempts so no more than 10 guesses are possible in 5 minutes, or lock the device after no more than 10 failed attempts. Where the vendor does not let you configure this, use its default setting.
Do I have to remove pre-installed apps for Cyber Essentials?
You must remove or disable software you do not need, including pre-installed applications, utilities and network services. Where something cannot be removed, disabling it is acceptable.