Cyber Essentials is built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The UK's NCSC calls it the government recommended minimum standard for organisations of all sizes. This checklist turns each control into questions your team can answer before registering.
The five controls
The NCSC lists them as: firewalls filter traffic between the internet and your network, secure configuration sets up devices to reduce ways in, security update management patches vulnerabilities, user access control limits who can reach what, and malware protection detects and stops malicious software.
Checklist
The questions below are our own preparation prompts. The authoritative wording sits in the IASME question set and requirements document, which you should download before you start.
Firewalls
- Do all laptops and offices have a firewall turned on?
- Do you know which services are exposed to the internet, and why?
Secure configuration
- Have default passwords been changed on every device and cloud account?
- Have unused accounts and software been removed?
Security update management
- Is every operating system and application still supported by its maker?
- Is there a routine that applies updates, and a record of it?
User access control
- Does every person have their own account?
- Is admin access limited to people who need it?
- Is multi factor sign in turned on where the service offers it?
Malware protection
- Is protection active on every device in scope?
- Are staff only able to install approved software?
Before you register
- Decide on scope. The NCSC says free cyber liability insurance, arranged by IASME, applies to UK organisations with turnover under 20 million pounds that certify their whole organisation. Check the current terms.
- Download the question set and the readiness tool from the NCSC pages.
- Pick a route, covered in our post on self led and supported routes.
- Keep screenshots and settings exports as you go. You may need them later.
What this does not cover
The five controls are a baseline. They do not replace application security, logging or incident planning. Treat certification as a floor.
Safeguard's asset discovery and compliance evidence automation can help you keep an inventory of devices and software that supports the first two controls. Check the current IASME requirements for any specifics.
Quick check
What are the five Cyber Essentials controls?
Firewalls, secure configuration, security update management, user access control and malware protection.
Who runs the scheme?
The NCSC developed it, and IASME is its official Delivery Partner.
Sources
Last reviewed: 19 October 2026.
