To implement Cyber Essentials yourself, take each of the five technical controls in turn, apply a short list of concrete settings across every in scope device and service, capture proof, then answer the assessment and have a board member sign it. Choose the self led or supported route through IASME.
What are you aiming at?
The NCSC overview we fetched on 18 October 2026 names five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials uses a self assessment plus independent marking, and a board member or equivalent signs it. Cyber Essentials Plus adds independent technical testing. Preparation tools on the page include a free question set and a readiness tool that produces an action plan. For a week by week schedule, see our 12 week calendar. This guide goes deeper on the settings.
Control 1: firewalls
Every device that reaches the internet should sit behind a firewall, either a network boundary one or the host firewall built into the operating system. Check three things.
- Default administrator passwords on routers and firewalls are changed.
- Inbound connections are blocked unless a rule allows them, and each rule has a written business reason.
- Remote administration of the firewall from the internet is off, or limited to named addresses with strong authentication.
For laptops used at home or in cafes, turn on the host firewall by policy and verify with a settings export.
Control 2: secure configuration
Strip out what you do not use.
- Remove or disable unused accounts, including old staff and default accounts.
- Uninstall software nobody needs, and turn off services you do not use.
- Require a password, PIN or biometric to unlock every device, with automatic lock.
- Change default passwords on every device, printer and appliance.
- Stop auto running files from removable media where your system allows it.
Write a baseline per device type, and use a management tool or a short checklist to apply it.
Control 3: security update management
Software must be supported and patched.
- Keep an inventory of operating systems and applications with versions.
- Replace anything no longer supported by its maker, or isolate it and record why.
- Turn on automatic updates where possible and set a rule for how fast high risk fixes are applied. Pick a number you can meet, then measure it monthly.
- Include routers, firewalls and mobile phones, not only laptops.
Control 4: user access control
- Each person has their own account, with no shared logins.
- Administrator rights go only to people who need them, and admins use a separate account for everyday work.
- Use multi factor authentication for cloud services that support it.
- Remove access on the day someone leaves, and review accounts regularly.
- Use strong, unique passwords and a password manager, and block known bad passwords where the tool allows.
Control 5: malware protection
Every in scope device should run reputable anti malware that updates itself and scans on access, or be restricted to approved applications from a trusted store. Check that protection is on and up to date, and that users cannot switch it off.
How do you answer the assessment?
Print the question set early. For each question, write the answer, the setting that supports it and where the proof lives. If you cannot prove an answer, treat it as a no and fix it. Be careful with scope: the NCSC page ties the free cyber liability insurance it mentions to certifying the whole organisation, so think hard before leaving parts out.
Which route should you pick?
Self led: register with IASME, pay, complete the verified self assessment, get it signed by a board member, and an assessor marks it. Supported: hire a licensed Certification Body that helps you understand the questions and assesses you. The page lists Cyber Essentials from 320 pounds plus VAT, tiered by size, as of our fetch, so check current pricing and validity on the official pages.
Mistakes to avoid
- Counting only office laptops. Phones, tablets and home devices that reach company data count.
- Leaving an old router on its default password.
- Enabling multi factor authentication for admins but not for email.
- Signing the form without checking the answers.
What to do
- Read the free question set and list every device and cloud service.
- Apply the firewall settings and record exports.
- Build and apply a configuration baseline.
- Patch, replace unsupported software and set a patch rule.
- Fix accounts, admin rights and multi factor authentication.
- Confirm malware protection on every device.
- Draft answers with proof, then choose the route and book board sign off.
Quick check
Do we need special tools?
No. Built in operating system features and a spreadsheet are enough for a small team, though a management tool helps with scale.
What does the board member sign?
The self assessment answers. It is a statement by a responsible person, so they should read it first.
How Safeguard helps automate this
Cyber Essentials sits mostly on devices, and Safeguard covers the software and evidence side. Safeguard's compliance suite covers frameworks, controls, evidence and continuous monitoring, so proof for patching and configuration can be collected from connected systems instead of screenshots, and stays current between assessments. Technical evidence comes from your real code and dependencies: scans and SBOMs show outdated and vulnerable libraries. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare, and the assessor decides the result. Book a call.
Sources
- NCSC, Cyber Essentials overview, fetched 18 October 2026. The page names the five controls but not detailed settings, so the specific settings above are our practical suggestions, not a quotation of the requirements document.
Last reviewed: 18 October 2026.
