The five Cyber Essentials technical controls

Cyber Essentials has five technical controls, set out in version 3.3 of the NCSC’s requirements: firewalls, secure configuration, security update management, user access control and malware protection. Each one applies to every device and cloud service in your scope. Applicants fail most often on late updates, cloud services without multi-factor authentication, unsupported software and administrator accounts used for everyday work.

The requirement in plain English

The requirements apply to every in-scope device and service that can reach the internet or be reached from it. There is no risk-based opt-out: if a device is in scope, all five controls apply to it.

Cyber Essentials, firewalls. Every in-scope device sits behind a correctly configured firewall: a boundary firewall on a network you control, or the device’s own software firewall where you do not control the network, as with home workers and public wifi. Change the firewall’s default administrator password or turn remote administration off. Keep its management interface off the internet unless you have a documented business need and protect it with multi-factor authentication, or with an IP allow list of trusted addresses plus well-managed passwords. Block unauthenticated inbound connections by default, have an authorised person approve and document every inbound rule with its reason, and remove rules you no longer need.

Cyber Essentials, secure configuration. Remove or disable accounts and software you do not use, change default and guessable passwords, and turn off auto-run. Make people sign in before they reach organisational data, and protect the sign-in to each device against guessing, by throttling to no more than 10 guesses in five minutes or locking after no more than 10 failed attempts, and at least six characters for a PIN or password that only opens the device.

Cyber Essentials, security update management. Every piece of in-scope software, including operating systems, applications and router and firewall firmware, must be licensed and supported by its vendor. Remove unsupported software, or move it into a separated sub-set with no internet traffic. Turn on automatic updates where you can, and install critical and high-risk fixes within 14 days of release.

Cyber Essentials, user access control. Run an approval process for new accounts, give everyone unique credentials, and disable accounts when people leave or stop using them. Use multi-factor authentication wherever it is offered and always for cloud services. Administrators use a separate account for administration only, with no email or browsing. For passwords, the requirements set out brute-force protection and a quality rule: multi-factor authentication, or at least 12 characters, or at least 8 with a deny list of common passwords. They advise against forced expiry and complexity rules.

Cyber Essentials, malware protection. Every in-scope device runs anti-malware software, kept updated and set to block malicious files, code and websites (the option for Windows and macOS), or application allow-listing, where only approved, code-signed apps can run.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

Take a 25-person design agency on Microsoft 365 with laptops and a few company phones.

Firewalls. The office router’s admin page is unreachable from the internet and has its own long password. The laptops’ built-in firewalls are switched on centrally, so they protect staff at home and in cafés. A short firewall rule register lists each inbound rule, who approved it and why, and is reviewed twice a year.
Secure configuration. One device-management tool enrols every laptop and phone before first use, applies a standard build with auto-run off and a screen lock, and lists the approved software.
Updates. Automatic updates are enforced, and the operations manager checks the device dashboard every Monday for anything older than 14 days, including the router’s firmware.
Access. Multi-factor authentication is enforced for every Microsoft 365 user. Two people hold separate admin accounts, used only for administration. A leaver checklist disables accounts on the last day, and an access review twice a year catches the ones it missed.
Malware. The built-in anti-malware on each laptop is managed centrally; phones install only from the managed app store.

They also back up and test a restore each quarter, which the scheme recommends without requiring it (see the backup and restore testing guide).

Evidence an auditor expects

The basic certificate is awarded on your signed answers, not on a document review. The scheme still asks you to keep some things, and a Plus assessor or a customer will look for the rest.

Firewall rule documentation: required. Each inbound rule with its approver and business reason.
Approved application list: required where you use allow-listing. The assessor checks users cannot install anything else.
Account creation and removal process: required to exist. A written leaver step and recent examples show it runs.
Device and software inventory: usual, not required. Without one you cannot answer the scope and update questions honestly.
Update reports: usual. A dated report showing nothing critical older than 14 days is what a Plus authenticated scan will confirm or contradict.
Multi-factor authentication settings for each cloud service: usual, and tested directly at Plus.
Malware console status: usual. Shows protection is active and current on every device, not most of them.

Keep the evidence dated, because the certificate speaks for one day and the next renewal starts from it.

Common mistakes

Counting 14 days from when you noticed

The clock starts at the vendor’s release, not when your dashboard flagged it. Router and firewall firmware, browser extensions and PDF readers are the usual stragglers. In the Danzell question set the two questions on 14-day updates, A6.4 for operating systems and firmware and A6.5 for applications, are automatic fails. Turn on automatic updates everywhere they exist and check the rest weekly.

Multi-factor authentication for administrators only

Version 3.3 requires multi-factor authentication for every user of every in-scope cloud service, not only for privileged accounts. A forgotten service, such as a design tool or a payroll portal holding your data, fails you as surely as the main email system. List every cloud service first, then check each one’s setting.

Keeping one unsupported machine for one old program

An unsupported operating system on a lab PC or a reception machine fails the update control. Removing it or moving it into a sub-set with no internet traffic are the only routes; the Plus test specification does not accept virtual patching (a network filter placed in front of the machine) as a long-term answer for an unsupported operating system.

Founders working as local administrator

Small organisations often give everyone admin rights on their own laptop. The requirement is a separate account for administration, and the Plus audit tests it by asking a normal user to run an administrative task. Remove local admin from daily accounts before you apply.

Password rules from 2010

Forced 90-day expiry and complexity rules are now things the requirements advise against. Meanwhile an 8-character minimum without a deny list or multi-factor authentication does not meet the quality rule. Move to multi-factor authentication or 12 characters.

How Sted helps

Sted’s knowledge base maps record templates to each Cyber Essentials control: the Network Security Configuration Record (REC-NSC) and Network Rule Review Record (REC-NRR) to firewalls; the Configuration Baseline Record (REC-CBR) and Approved End-User Technology Record (REC-AET) to secure configuration; the Vulnerability Record (REC-TIV) and Technical Assurance Test Record (REC-TAT) to security update management; the Access Review Record (REC-ARR), Authentication Configuration Record (REC-ACR) and Credential Issuance and Reset Record (REC-CIR) to user access control; and the Malware Protection Configuration Record (REC-MPR) and Malware Protection Review Record (REC-MPRR) to malware protection.
Records are part of the Full Management System plan.
For Cyber Essentials Sted’s knowledge base carries 8 policies and 11 record templates mapped to the five technical controls, led by the Network Security, Configuration Management, User Access Control (Access Control), Malware Protection, Password and Authentication, and Threat Intelligence and Vulnerability Management policies.
Among the Cyber Essentials record templates, the Access Review Record and the Network Rule Review Record come with a suggested frequency of twice a year and the Technical Assurance Test Record a quarterly one; nothing is scheduled until you pick a first due date.
Records are part of the Full Management System plan.
Sted does not connect to your cloud, code or HR systems to collect evidence automatically; you record it.
Sted does not run penetration tests or scans; it records the result and tracks the actions.

Sted does not scan your devices or check update levels. You answer the self-assessment and record the evidence, and an assessor marks your answers.

Cyber Essentials: the scheme, its editions, cost and certification route.
Cyber Essentials scope: which devices and cloud services the five controls apply to.
Cyber Essentials self-assessment and Cyber Essentials Plus: how the controls are marked and tested.
ISO 27001 technological controls: where the same controls sit in an ISO 27001 system.
Control: what the docs mean by a control across standards.

Frequently asked questions

How long do I have to install a critical update for Cyber Essentials?

14 days from the day the vendor releases it. That applies to fixes the vendor rates critical or high risk, fixes for vulnerabilities scoring 7 or more on CVSS version 3, and any fix whose severity the vendor does not state. An update that bundles one critical fix with minor ones counts as critical.

Do phones and tablets need antivirus software for Cyber Essentials?

Not necessarily. Version 3.3 offers anti-malware software as the option for Windows and macOS devices, and application allow-listing as an option for every device. A phone that runs only approved, code-signed apps, where users cannot install unsigned ones, meets the control without an antivirus app.

Is a backup a Cyber Essentials requirement?

No. Version 3.3 says backing up is not a technical requirement of the scheme, though the NCSC strongly recommends it and gave it more space in this edition. Ransomware recovery depends on it, so most organisations test restores anyway.