Are you ready for Cyber Essentials?

You know every device that accesses business data or services, including staff-owned phones and laptops used for work email or files. Phones used only for calls, texts or an authenticator app do not count.

You know every cloud service the business uses, such as Microsoft 365, Google Workspace, Dropbox, or accounting and CRM software. Cloud services cannot be left out of scope.

Your office internet connection is protected by a firewall, usually built into your router, and its default admin password has been changed to a strong, unique one.

The firewall's settings page cannot be reached from the internet. If it has to be, there is a documented reason and it is protected by multi-factor authentication or limited to a small list of trusted IP addresses.

Incoming connections from the internet are blocked by default. Any exceptions, such as port forwarding, are approved and documented with a business reason, and removed when no longer needed.

The built-in firewall is switched on on every laptop and desktop, so they are protected at home, on public Wi-Fi and anywhere you do not control the network.

Default and easily guessed passwords have been changed on every device and piece of software.

Software, services and accounts nobody uses, such as guest accounts and spare admin accounts, have been removed or disabled.

Auto-run is switched off, so files and USB sticks cannot run anything without someone approving it.

Every device needs a fingerprint, face, password or PIN of at least six characters to unlock, and locks or makes you wait after no more than 10 wrong attempts.

Every operating system, app and piece of router or firewall firmware is licensed and still supported by its maker. Anything out of support has been removed or cut off from the internet.

Updates rated critical or high risk, or whose severity the maker does not state, are installed within 14 days of release on every device, including phones, routers and firewalls.

Automatic updates are switched on wherever they are available.

There is a set process for creating and approving accounts. Everyone has their own login, nobody shares one, and people only have access to what their role needs.

Admin accounts are separate from everyday accounts and only used for admin tasks, never for email or web browsing.

Multi-factor authentication is switched on for every person on every cloud service, with no exceptions. It is also used on admin accounts and anything reachable from the internet wherever it is available.

Where a password is used without multi-factor authentication, it is at least 12 characters, or at least 8 with common passwords automatically blocked, and repeated wrong guesses are locked out or slowed down.

Accounts are disabled promptly when someone leaves, and extra access or admin rights are removed when someone changes role.

Accounts used by your IT provider, contractors or other suppliers to manage your systems follow all of these rules too.

Every Windows and Mac computer has anti-malware switched on, kept up to date and set to block malware and malicious websites. The built-in Microsoft Defender counts.

Phones and tablets can only install signed apps from the official app stores, with installing apps from elsewhere switched off.