Cyber Essentials and Cyber Essentials Plus is a voluntary cyber security framework certification that companies in the UK can achieve. It offers practical benefits in keeping your business’s digital data safer, while also offering a symbol of credibility that companies can use to increase client confidence. However, it requires an “all-or-nothing” approach, meaning failure on any part of the Cyber Essentials checklist will result in overall failure.

This article will give you insights into the checklist you should cover during Cyber Essentials training to guarantee that you can pass on your first try. This article should set you up for success with the five pillars of both standard Cyber Essentials and Cyber Essentials Plus.

Firewall & internet gateway fundamentals

Having a good firewall with strong internet gateways protects your internal network from the outside world.

Credentials and passwords across routers, firewalls and network switches must be changed.
Boundary firewalls must protect the network and software firewalls have to be enabled on every mobile worker device.
All unauthenticated inbound traffic must be blocked by default. Similarly, any open ports have to be verified with documented business justification.
All internet-facing administrative access to firewalls must be disabled, unless protected by multi-factor authentication or IP whitelisting.

Secure configuration rules

You have to guarantee that all your computers and network devices are configured securely, rather than simply using the out-of-the-box defaults.

Uninstall all bloatware, meaning all the unnecessary pre-installed software, sample applications and unused guest accounts.
Enforce automatic screen lock policies (PIN/password/biometric) on all laptops, desktops and mobile devices after brief periods of inactivity.
Make sure that all auto-play/auto-run features across operating systems are switched off, as it could allow for unauthorised code running.
Every password needs to be at least 8 characters long with MFA or 12+ characters without MFA, along with brute-force throttling principles in place.

User access control

Keep unauthorised visitors away from corporate data and cloud services with strict access control protocols.

Enforce strict processes to revoke user access immediately when an employee or contractor leaves or changes roles.
Maintain MFA across every cloud service, from Microsoft 365 to Google Workspace and any remote access VPNs. Missing MFA on cloud services is a primary cause of assessment failure.
Make sure that standard staff accounts don’t have administrative privileges. Admin access should be separate, with clear dedicated accounts for maintenance.

Malware protection essentials

Cyber Essentials compliance requires protecting in-scope devices from malicious software execution.

Every single device, from laptops to mobile devices (including BYOD devices with corporate data), must run approved malware protection.
Anti-malware / antivirus software must be set to update definitions automatically and perform real-time scanning on downloads and execution.
Only pre-approved applications should be allowed on company-owned devices.
Operate system app isolation (which is standard on modern iOS and Android devices).

Security update management & patching

Make sure that all your operating systems and third-party software are regularly updated.

Ensure that every piece of software that you use is properly licensed so it receives official security patches.
All your EOL software needs to be uninstalled and segregated from in-scope network devices, as unsupported or EOL software results in automatic assessment failure.
All security patches must be applied across all operating systems, software, hardware and firmware within 14 days of release.

Covering your tracks entirely

A passing grade in a Cyber Essentials assessment requires you to cover every single aspect of these five pillars, or you’ll be hit with a failing grade. Don’t compromise on any singular aspect, as this will sink the entire operation.

Don’t be afraid to work with a support team when it comes to crossing off your Cyber Essentials checklist, as a second set of eyes can help to point out blind spots that you weren’t aware of.