Cyber Essentials has five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Engineers can prepare by inventorying devices and cloud services, hardening each against those five, and keeping dated evidence before filling in the verified self assessment.
What is the scheme, exactly?
The UK's NCSC describes Cyber Essentials as the minimum standard of cyber security the government recommends. There are two levels assessing the same five controls. Cyber Essentials is a verified self assessment, where a board member or equivalent signs off the answers and an assessor marks them. Cyber Essentials Plus adds a technical audit and testing for higher assurance. You can go self led through IASME, or use a licensed Certification Body.
The detailed requirements document returned an error when we tried to fetch it, so figures below such as patch windows should be confirmed in the current version of the requirements.
Step 1: scope and inventory
List every device, server and cloud service that touches organizational data, including laptops, phones, home routers if used for work, virtual machines and SaaS. Scope drives every answer, so do this properly.
Control 1: firewalls
Every internet boundary needs a firewall: office routers, cloud security groups, host firewalls on laptops. Block inbound by default, open only documented ports, remove default admin passwords and restrict admin interfaces. Keep an export of the rules and the review date.
Control 2: secure configuration
Remove software and accounts you do not need. Change default credentials. Turn on disk encryption and screen locks. Set a build baseline for laptops and servers and keep it in code or in device management policy. Evidence: baseline document, configuration exports, a sample of devices checked.
Control 3: security update management
Keep operating systems and applications supported and patched. The requirements document is understood to require critical and high risk updates within 14 days, so confirm the current wording. Remove unsupported software. Evidence: patch reports from device management, a list of software with versions, and exceptions with decisions.
Control 4: user access control
One account per person, admin rights only where needed and separate from daily accounts, and multi-factor authentication on cloud services wherever it is available. Close accounts promptly when people leave. Evidence: user lists, role assignments, MFA enforcement screens, joiner and leaver tickets.
Control 5: malware protection
Use anti-malware on devices, or restrict what software can run, such as through app stores or allow lists. Keep it updated and enabled. Evidence: console screenshots or exports showing coverage.
Engineering notes
Your build pipeline and container images count when they run as part of the scoped environment. Treat base images as software that needs updating, and keep a record of version pinning and rebuild cadence.
How should you organize the evidence?
Create one folder per control with a dated export, a short note on scope and the person who reviewed it. Add a one page index that lists each in-scope device group, who owns it and when it was last checked. When the assessor asks a question you can then answer with a file, not a search through chat history. Re-capture evidence close to submission, since an old patch report or a stale user list is the most common reason an answer needs correcting.
Mistakes to avoid
- Forgetting personal devices that connect to work email.
- Cloud admin accounts without MFA.
- Scoping out a subnet that handles customer data.
- Unsupported operating systems left on one old machine.
- Rushing the self assessment without a board member reading it.
What to do
- Inventory every in-scope device and service.
- Review and export firewall rules.
- Apply and document a configuration baseline.
- Patch, remove unsupported software, and keep a patch report.
- Enforce one person one account, least admin, and MFA.
- Confirm malware protection on every in-scope device.
- Have a board member review before submitting.
Quick check
What are the five Cyber Essentials controls?
Firewalls, secure configuration, security update management, user access control and malware protection.
What is the difference between Cyber Essentials and Plus?
Both assess the same five controls. Plus adds an independent technical audit and testing for higher assurance.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. The five controls are all state that drifts, so continuous checks help.
Technical evidence comes from your real code and dependencies, through scans, SBOMs and reachability, which is useful for the update management control where software versions matter. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Cyber Essentials is assessed by IASME or a licensed Certification Body. Safeguard helps prepare and keep evidence ready, and does not certify you.
See it at /demos/framework-mapping.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
