What Cyber Essentials actually asks for

Cyber Essentials is a UK government-backed scheme. It asks whether your organisation has the basics in place across five technical control areas. IASME runs the assessment platform; you answer a questionnaire and, for Cyber Essentials Plus, face a technical audit as well.

We do not reproduce IASME’s exact questions here. What follows is a plain-English map of what the scheme is driving at, based on public NCSC guidance.

1. Firewalls

Boundary and host firewalls protect devices in scope. Default admin passwords on network kit are gone. Inbound unauthenticated connections are blocked. Admin interfaces are not exposed to the internet without compensating controls.

2. Secure configuration

Unnecessary accounts, features, and software are removed. Default credentials are replaced. Auto-run is disabled. Users authenticate before access. Cloud admin accounts use MFA.

3. User access control

Named accounts, approval before provisioning, admin accounts separated from daily use, MFA on cloud admin, sensible password rules, leavers removed promptly, and periodic access review.

4. Malware protection

One of the recognised methods (anti-malware, allowlisting, or sandboxing) on every in-scope device, with definitions current and on-access scanning where that method applies.

5. Security update management

Critical and high patches applied within the scheme’s window, unsupported software removed, and automatic updates enabled by default where practical.

BYOD — the scope trap

Personal devices that reach corporate email or documents are often in scope. If BYOD is unmanaged, that alone can block a clean submission. Options: control it properly, exclude it by stopping corporate data on personal devices, or issue corporate devices.

If this list already surfaces gaps you cannot evidence, a readiness assessment is usually cheaper than a failed £320+VAT application.

Get in touch for a free scoping call, or download the six-policy pack.