Cyber Essentials readiness checklist

The five technical controls as IASME publishes them, broken into what the self-assessment question set actually asks you to confirm.

Read this first. Cyber Essentials assesses your whole internet-facing estate including cloud services and staff devices. Scoping the assessment to one part of the business is only permitted where that part is genuinely segregated.

0 of 16

Firewalls

Every device protected by a firewallA boundary firewall, or a host-based firewall on devices used on untrusted networks.Control 1Default administrative passwords changedOn every firewall and internet-facing device.Control 1Inbound rules documented and justifiedEach open port approved, recorded, and removed when no longer needed.Control 1Firewall administration not exposed to the internetOr protected by multi-factor authentication or an IP allow list.Control 1

Secure configuration

Unnecessary accounts and software removedIncluding default and guest accounts, and preinstalled software you do not use.Control 2Auto-run disabledSo removable media cannot execute code without the user choosing to.Control 2Device unlocking protectedA password, PIN or biometric, with brute-force protection.Control 2

User access control

A documented account creation and approval processAccounts created only after approval by someone authorised to give it.Control 3Accounts removed promptly when no longer neededLeavers and role changes both count.Control 3Administrative accounts used only for administrative tasksSeparate accounts for day-to-day work such as email and browsing.Control 3Multi-factor authentication on all cloud servicesFor both administrators and standard users. This is the single most common reason for a failed assessment.Control 3

Malware protection

Anti-malware, allow listing, or sandboxing in placeOne of the three approaches on every in-scope device.Control 4Signatures and engine kept currentWhere anti-malware software is the chosen approach.Control 4

Security update management

All software licensed and supportedUnsupported software on an in-scope device fails the assessment outright.Control 5Critical and high severity updates applied within 14 daysFrom the vendor release date. This is a hard deadline, not a target.Control 5Automatic updates enabled where availableAcross operating systems, applications, firmware and browser plugins.Control 5

Your ticks stay in this browser tab and are not saved or sent anywhere. Refreshing clears them.

Keep reading

FrameworkCyber Essentials: what it is and who assesses it

InsightCyber Essentials and Cyber Essentials Plus: the definitive guide

ToolWork out which frameworks apply to you

Ticked most of it and stuck on the rest?

Cyber Essentials is assessed by self-assessment, verified by an iasme certification body. We run the programme up to that point and manage the assessment itself.

Book a free consultation