On this page
The Cyber Essentials framework is five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Together they block the most common internet-based attacks: exploiting unpatched software, guessing or stealing passwords, and getting malware onto a device. Every device, account and cloud service in your scope must meet all five. The detailed rules are in the NCSC’s Requirements for IT Infrastructure v3.3, and IASME, which delivers the scheme for the NCSC, explains each control on its Cyber Essentials Knowledge Hub.
Each control is simple in principle. Most failed assessments we see as an IASME-licensed certification body come down to one detail: a router on its factory password, an unsupported laptop, a cloud app without multi-factor authentication (MFA). This guide explains what each control involves and where organisations slip.
Key takeaways
- The five controls apply to everything in scope: devices, servers, network equipment and cloud services.
- High-risk and critical updates must be installed within 14 days; since April 2026 missing this is an automatic fail.
- MFA must be enforced on every cloud service that offers it.
- Passwords need 8 characters with MFA, or 12 without (8 if common passwords are blocked).
- Anti-malware or application allow listing must be active on every in-scope device.
What are the 5 Cyber Essentials controls?
| Control | What it stops | What it means in practice | Most common failure |
|---|---|---|---|
| Firewalls | Attackers reaching services that shouldn’t be exposed | Every device sits behind a correctly configured boundary or software firewall | Router admin page still on its default password |
| Secure configuration | Attackers using defaults and unused features | Remove what you don’t need, change default passwords, lock devices | Old accounts and remote-access tools left in place |
| Security update management | Exploitation of known vulnerabilities | Supported software only, high and critical updates within 14 days | Firmware and third-party apps missed |
| User access control | Stolen or guessed credentials being used | Unique accounts, least privilege, separate admin accounts, MFA | One cloud app without MFA |
| Malware protection | Malicious code running on devices | Anti-malware or application allow listing on every device | Protection switched off on a server |
These five controls are what an assessor marks you against. Our Cyber Essentials requirements checklist turns every rule into a check you can tick off, with the evidence to have ready.
What do the controls apply to?
The controls apply to your whole scope, which is either the entire organisation or a clearly separated part of it. That includes:
- Desktops, laptops, tablets and phones that access organisational data or services, including staff-owned devices.
- Servers, whether on premises or hosted.
- Firewalls, routers and other network devices you supply.
- Cloud services such as Microsoft 365, Google Workspace and any business app your staff sign in to. These cannot be excluded.
The mistake we see most is leaving out home workers or a cloud service one team adopted on its own. If you’re unsure where the boundary sits, our free Cyber Essentials scope questionnaire walks you through it.
Firewalls
Every in-scope device must be protected by a correctly configured firewall: a boundary firewall or router, a software firewall on the device, or both. The assessor will look for:
- Default administrative passwords changed on every firewall and router, to a strong, unique password.
- No admin interface reachable from the internet, unless there is a documented business need and it is protected by MFA or an IP allow list.
- Inbound connections blocked by default. Every rule that allows inbound traffic must be approved, documented with a business reason and removed when no longer needed.
- Software firewalls switched on for devices used on untrusted networks, such as home wifi, hotels and coffee shops.
Home workers’ own broadband routers are out of scope, so the firewall on the laptop does the job instead. If you supply the router, treat it like an office one.
Secure configuration
Secure configuration means removing the easy ways in, because devices and software ship set up for convenience, not security. In practice:
- Remove or disable unnecessary accounts, including guest and unused admin accounts.
- Change default or guessable passwords on every device and application.
- Remove software, utilities and services you don’t need.
- Stop auto-run from executing files without the user’s authorisation.
- Require users to authenticate before they reach organisational data or services.
- Lock devices with a password, PIN or biometric. A PIN that only unlocks the device needs at least 6 characters, with protection against repeated guessing.
Security update management
Security update management, or patching, means all software on in-scope devices must be licensed and supported by its vendor, and high-risk or critical updates must be installed within 14 days of release. That covers operating systems, applications, browser extensions, and router and firewall firmware.
An update falls under the 14-day rule if the vendor rates it critical or high risk, if it fixes a vulnerability with a CVSS v3 base score of 7 or above, or if the vendor gives no severity. Turn on automatic updates wherever you can.
Since the April 2026 Danzell question set, two questions on this control are automatic fails: one covering operating systems and router and firewall firmware, the other covering applications. Our guide to the Cyber Essentials changes for 2026 explains them.
Unsupported software, such as an operating system past its vendor’s end-of-support date, must be upgraded, removed or moved into a segregated network with no internet access that sits outside scope.
User access control
User access control makes sure only the right people have accounts, and only with the access they need:
- A process to create, approve and remove accounts, so leavers lose access promptly.
- Unique accounts for every user. No shared “office” or “admin” logins.
- Separate administrator accounts, used only for admin tasks and never for email or browsing.
- Special privileges removed when someone changes role.
- MFA wherever it is available, and always on cloud services. Since April 2026, a cloud service that offers MFA without it enforced fails the assessment outright.
Accounts your IT provider or managed service provider uses to run your systems are in scope too. Our guide to Cyber Essentials MFA requirements sets out where MFA is required and which methods are accepted.
What password policy does Cyber Essentials require?
Password rules sit within user access control. In short, a password used with MFA needs at least 8 characters, one without MFA needs at least 12 (or 8 with common passwords blocked automatically), and password sign-in needs protection against guessing through MFA, throttling or lock-out. Our Cyber Essentials password policy guide sets out the full v3.3 rules, including lock-out limits, password managers and expiry.
Malware protection
Every in-scope device needs an active, up-to-date malware protection mechanism, using at least one of two options:
| Option | Typical use | It must |
|---|---|---|
| Anti-malware software | Windows and macOS devices, including servers | Update in line with the vendor, stop malware running and block connections to malicious websites |
| Application allow listing | Phones, tablets and locked-down devices | Allow only approved, code-signed applications and stop users installing anything else |
Built-in protection such as Microsoft Defender is acceptable, provided it is switched on and configured correctly.
These are the only two options. Application sandboxing, which older guidance lists as a third, was removed from the requirements in April 2023 (v3.1, the Montpellier question set), so it does not meet this control on its own.
How do the five controls work together?
They reinforce each other. A firewall limits what an attacker can reach. Secure configuration and patching limit what they can exploit. Access control limits what a stolen account can do. Malware protection catches what gets through. A gap in one puts more weight on the others, which is why the scheme requires all five.
How are the controls assessed?
For basic Cyber Essentials you answer the Danzell question set, a board-level representative signs to say the answers are true, and an assessor marks them. You can preview every question on our Cyber Essentials questionnaire page. For Cyber Essentials Plus, an assessor also tests the same controls on a sample of your devices. Our comparison of Cyber Essentials vs Cyber Essentials Plus explains the difference.
The current rules are published on the NCSC Cyber Essentials resources page.
Why use Sovereign Secure?
Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body. Every package includes a pre-assessment check and a support call of up to an hour, so gaps in any of the five controls are found before you submit. We are also ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company.
Next step
If you can tick off all five controls, choose a package for your Cyber Essentials certification; prices start at £320 + VAT on our Cyber Essentials cost page. If you’d like a quick view of your gaps first, try our Cyber Essentials readiness check.
Free tools and services
- Readiness checkAnswer 20 questions for a readiness score and a fix list before you apply.Start the free check
- Cyber Essentials pricesPackages for every company size, from £320 + VAT.See CE prices
- Get a CE+ quoteTell us about your devices and cloud services for a Cyber Essentials Plus quote.Get a CE+ quote
