Cyber Essentials: the five controls, and how we follow them

Cyber Essentials is the UK government-backed scheme, run by the National Cyber Security Centre and delivered through IASME, that certifies an organisation has five basic technical controls in place. Clients, insurers and public sector buyers ask for it more every year, and the latest update has made renewal meaningfully harder.

This page does two things. It explains what each control actually asks for, in plain English rather than scheme language. And it sets out how we apply the same five controls inside our own business, because a security company that cannot answer that question is not one you should hire.

What changed

The recent update brought several things firmly into scope that smaller organisations were not evidencing before:

• Cloud services are in scope. Microsoft 365, Google Workspace, accounting and line-of-business software all count, including anything a single department signed up for without telling anyone.
• Home and remote-working devices are in scope. Anything used for work, wherever it is, including personally owned devices that touch company data.
• Multi-factor authentication is mandatory on all internet-facing cloud services, for every user, not only administrators.
• A full software inventory is expected, with evidence of what is installed across your devices rather than an assurance that you know.
• High and critical security updates within 14 days of release, with documented evidence rather than a claim.

The common thread is evidence. It is no longer enough to say you do these things. You have to be able to show it, and the showing is where most of the work now sits.

The five controls, in plain English

Under each one: what the scheme asks for, and what we do about it in our own business. Where our answer is short, that is because the control is genuinely simple at our size, not because we have skipped it.

1. Firewalls

What it asks for. A firewall between your network and the internet, and the firewall built into every device switched on. Default administrative passwords changed. No services exposed to the internet unless there is a documented business case, and any that are, protected by an approved rule and a strong password or multi-factor authentication.

What we do. Device firewalls are enabled on every machine we use and are not left to individual discretion. We expose no inbound services from our office network: remote access runs over authenticated services rather than open ports, so there is no management interface sitting on the public internet waiting to be found. Anything we deploy for a client has its default credentials changed before it goes anywhere near a network.

2. Secure configuration

What it asks for. Devices and software set up deliberately rather than left at defaults. Unused accounts and applications removed. Default passwords changed. Auto-run disabled so untrusted code cannot execute on its own. Devices locked after a period of inactivity, and protected by a password, PIN or biometric.

What we do. Machines are built from a standard configuration rather than set up ad hoc, so nothing depends on somebody remembering a step. Full disk encryption is on. Screens lock on inactivity. We run no shared logins for anything, which matters more than it sounds: a shared account is one you cannot revoke, audit or attribute.

3. User access control

What it asks for. A process for creating and approving accounts. Least privilege, so people hold only the access their role needs. Separate administrator accounts used only for administrative work, never for email and browsing. Multi-factor authentication on cloud services. Access removed promptly when someone leaves or changes role.

What we do. Every account is individual and attributable. Multi-factor authentication is on for every cloud service we use, without exception, because a partial rollout is the same as none for whichever account was missed. Administrative rights are held separately from day-to-day accounts. Where an engagement gives us access to a client system, that access is scoped to the work and removed when the work ends, rather than left in place in case it is useful later.

4. Malware protection

What it asks for. One of three approaches on every device: anti-malware software kept current, application allow-listing so only approved software runs, or sandboxing. Most organisations use the first.

What we do. Endpoint protection runs on every device, updates automatically, and is not something a user can quietly disable. We add DNS filtering on top, which stops a device reaching a known malicious domain even when something has already got past the first layer. Software is installed from vendor or platform sources rather than from search results.

5. Security update management

What it asks for. Only supported software, licensed and still receiving security updates from its vendor. Automatic updates enabled where available. High and critical updates applied within 14 days of release. Software that is no longer supported removed from the device.

What we do. Operating systems and browsers update automatically. High and critical patches are applied within the 14 day window rather than at a convenient moment. Unsupported software is removed rather than kept because it still works, which is the single most common thing we find in other people’s estates and would be embarrassing to have in our own.

Where we stand on certification

We are not currently certified to Cyber Essentials. We follow the five controls and we are willing to describe exactly how, which is what the rest of this page is, but we hold no certificate and we will not imply otherwise. Certification is issued by an accredited certification body after an assessment, not by a consultancy, and self-assessment is not the same thing.

We would rather say that plainly than let a badge do the implying. If your procurement process requires a supplier to hold the certificate, say so early and we will tell you honestly whether we meet the bar today.

Getting ready for yours

Staying certified after the first year

Most firms pass the first time and then struggle at renewal, because the estate moves and the evidence does not. A laptop joins without the standard build. Someone signs up for a new cloud tool. A machine falls off the patch schedule and nobody notices for four months. None of it is negligence, it is just what happens when nobody owns the question.

Three things make renewal ordinary rather than a scramble. Keep a current list of devices and cloud services, because you cannot evidence what you cannot enumerate. Check multi-factor authentication coverage periodically rather than assuming it, since new accounts are where gaps appear. And keep the evidence as you go, so the questionnaire is a transcription job rather than an investigation.

If you would rather someone owned it, that is part of what a retained security lead does.

Last reviewed 19 September 2026. Questions about anything here: [email protected].

Not sure where you stand? Take the free security check. It asks a few non-technical questions and tells you which of these controls you are likely to fail on today.