Cyber Essentials certifies that five technical controls were in place when you were assessed. Keeping them true afterwards takes a light routine: a monthly check of devices and updates, a quarterly review of accounts and firewall rules, and a trigger list for changes such as new cloud services or new offices that alter your scope.
What are you keeping up?
The NCSC describes Cyber Essentials as aligned to five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The requirements document is reviewed regularly. Version 3.3 took effect on 27 April 2026, and applications started before then can follow version 3.2. When you renew, read the current version for changes, because definitions and scope rules do move. Version 3.3, for example, states that cloud services cannot be excluded from scope.
What should you check monthly?
Updates. The requirements say updates that fix vulnerabilities rated critical or high, meaning a CVSS v3 base score of 7 or above, or described that way by the vendor, must be applied within 14 days of release. Check every in scope device and application against that clock. Include routers and firewall firmware.
Unsupported software. Software that is no longer licensed and supported must be removed or fenced off from the internet. Run a monthly inventory report and look for end of life operating systems and applications.
New devices. Confirm every laptop, phone and server that joined this month met the baseline before it got access.
Malware protection. Confirm the protection you rely on is installed, current and not disabled on each device.
Evidence to keep: a dated report per month, with exceptions and the ticket that fixed each one.
What should you check quarterly?
Accounts. Review user and administrator accounts. Remove leavers, remove accounts nobody uses, and confirm administrators use separate accounts for administrative work. Confirm multi-factor authentication is enforced where the requirements call for it, including cloud services that hold your data.
Firewall rules. Review inbound rules, close anything with no current business reason, and confirm default administrative passwords are still changed and management interfaces are not open to the internet.
Configuration. Spot check devices for unnecessary software, auto-run settings and default accounts.
Scope. Compare your scope statement with reality. New SaaS tools, new offices, contractors using personal devices and new home working arrangements all change what is in scope.
Evidence: dated review records with a reviewer name, the list of changes made and who approved them.
Which events should trigger a check right away?
- A new cloud service or SaaS tool that holds business data.
- A new office, a move, or a router change.
- An acquisition or a new subsidiary.
- A change in how people work, such as a bring your own device policy.
- Staff turnover in IT.
- Any security incident.
- A new version of the requirements.
Add a line about Cyber Essentials to your change and onboarding checklists so these triggers are caught by process, not memory.
What goes wrong after certification?
- Drift in patching. The 14 day window slips because nobody owns it.
- Shadow cloud accounts. Someone signs up for a tool with company data and no MFA.
- Leavers keep access. Offboarding is an IT task nobody schedules.
- Test devices. A spare laptop outside inventory runs an old operating system.
- Firewall exceptions that never expire. Every rule needs an owner and a review date.
- Sign-off ignored. The self-assessment answers are approved by a board member or equivalent, so they should see the quarterly results too.
What if you want more assurance?
Cyber Essentials Plus adds independent technical testing of the same controls. The NCSC site describes the difference: both versions assess five controls, but Plus verifies they work in practice. Whichever you hold, an internal routine like this one means the answers you gave are still true when someone checks.
What to do
- Assign one owner to each of the five controls.
- Put the monthly and quarterly checks in the calendar with named reviewers.
- Generate device and update reports automatically where your tools allow.
- Add the trigger list to change and onboarding checklists.
- Keep dated evidence in one folder per year.
- Four months before renewal, re-read the current requirements and compare to your scope.
Quick check
How fast must critical and high security updates be installed?
The requirements state within 14 days of release for updates fixing vulnerabilities the vendor calls critical or high risk, or that score CVSS v3 7 or above, or where no severity detail is given.
Can cloud services be left out of Cyber Essentials scope?
No. Version 3.3 of the requirements states that cloud services cannot be excluded from scope.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between assessments. Where software you build or ship is in scope, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability show which vulnerable packages need attention. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. Certification is decided by an assessor under the scheme. Book a call.
Sources
- NCSC Cyber Essentials overview
- NCSC Cyber Essentials help and resources
- Cyber Essentials Requirements for IT Infrastructure v3.3
Last reviewed: 18 October 2026.
