What is Cyber Essentials and why does it exist?
It’s a UK government-backed certification that establishes a baseline of cybersecurity against common attacks. It builds customer trust and demonstrates that the organization meets minimum technical safeguards.
What are the two levels of Cyber Essentials certification?
Cyber Essentials — Self-assessment against core controls.
Cyber Essentials Plus — Includes independent technical audit and vulnerability testing.
What must be clearly defined in the scope of certification?
The boundary of certification, including all in-scope IT assets — such as devices, servers, cloud services, remote endpoints, and internet-facing systems.
All must comply with Cyber Essentials controls.
What are the key Cyber Essentials requirements for firewalls?
Protect all internet-facing devices.
Change all default passwords.
Allow only necessary ports and services.
Use IP allowlisting for trusted connections.
Block unauthenticated inbound traffic.
Enforce MFA for cloud admin panels.
What defines secure configuration in Cyber Essentials?
Remove unused accounts/software.
Change default credentials.
Enforce strong passwords and disable auto-run.
Authenticate all access.
Regularly review settings and secure new devices before deployment.
What are the core principles of user access control under Cyber Essentials?
Approve and document all new accounts.
Remove inactive accounts.
Separate admin and user roles.
Enforce MFA for all logins.
Apply least privilege and unique credentials.
Audit permissions regularly.
How must organizations protect against malware?
Use up-to-date anti-malware software with web and email scanning.
Prevent unauthorized software installations.
Maintain allowlists.
Protect IoT and cloud systems.
Update malware tools daily (or as required).
What are the patching and update requirements?
Only use supported, licensed software.
Remove outdated applications.
Automate updates where possible.
Apply critical/high-risk patches (CVSS ≥7) within 14 days.
Track patch coverage and compliance across all devices.
What documentation is needed for Cyber Essentials certification?
Asset inventories, access logs, patch records, and configuration baselines.
For Cyber Essentials: complete the self-assessment.
For Cyber Essentials Plus: support external audit and vulnerability scans.
How should organizations maintain compliance after certification?
Integrate controls into daily IT operations.
Review and update regularly as threats evolve.
Train users and prepare for annual recertification.
Act swiftly on audit findings or failed controls.
Why is communication important in Cyber Essentials?
Builds executive and staff buy-in.
Ensures everyone understands password, phishing, and device security expectations.
Embeds secure practices into onboarding, training, and everyday processes.
What’s the ultimate goal of Cyber Essentials?
To create a culture of baseline cyber hygiene that protects organizations from common threats, supports customer confidence, and demonstrates responsible cyber governance.
How does asset management support Cyber Essentials compliance?
While not a standalone control, effective asset management is crucial for tracking and controlling all devices and software in scope. Good asset management enables the organization to quickly identify which IT assets need to comply, makes deployment of updates and controls easier, and reduces risks related to unauthorized or unknown devices.
What is the importance of defining the physical and network boundary in Cyber Essentials scope?
Clearly establishing the physical location, managing business units, and network segments ensures that all in-scope devices and services—whether managed in one site, multiple offices, or remote/home worker devices—are covered by Cyber Essentials controls. It ensures no gaps in security coverage.
How is Bring Your Own Device (BYOD) addressed in Cyber Essentials?
All user-owned devices accessing organizational data or services must be in scope, except devices exclusively used for basic telephony, SMS, or MFA applications. BYOD increases complexity as controls must be implemented on less standardized devices, so policies and technical controls are needed to ensure compliance.
How does Cyber Essentials cover home and remote working?
All corporate or BYOD devices used for home or remote work are in scope. If a company-supplied router is provided, it’s in scope; otherwise, software firewalls must be active on devices. If a remote worker connects via corporate VPN, the firewall boundary moves to the organizational firewall.
Which wireless devices fall in scope for Cyber Essentials?
Wireless access points communicating via the internet are in scope. Home/remote location routers provided by the org are in scope, but ISP-owned customer routers are not. Wireless devices that can’t be attacked directly over the internet are excluded from scope.
What is the responsibility regarding cloud services in Cyber Essentials?
If using cloud services to process/store data, these must be included in scope. The applicant is responsible for ensuring all relevant controls are implemented—sometimes directly, sometimes by ensuring proper contractual commitments from cloud providers.
Who typically implements firewall controls for cloud services (IaaS, PaaS, SaaS)?
For IaaS: both organization and provider. For PaaS: provider or sometimes the org. For SaaS: provider implements. Still, the applicant must ensure controls are present by policy or contract.
How should accounts used by third parties or MSPs be managed under Cyber Essentials?
Accounts owned by the organization, even if used by external admins, are in scope and must comply. The organization must ensure that outsourced service providers maintain all technical controls, with evidence provided during assessment.
What is required for devices loaned to third parties?
Devices owned by the organization and given to volunteers, contractors, or similar parties must be included in the scope. For third-party-owned devices accessing services, responsibility lies with the organization to require and monitor correct configurations.
How are web applications treated in Cyber Essentials?
Public, commercial web applications used by the organization are in scope by default; custom-built or in-house code is not. Security depends on the developer—organizations are encouraged to use best practice like the OWASP ASVS for resilience.
What is the key aim of the firewall control?
To ensure only necessary and secure network services are accessible from the internet, and to restrict all unauthenticated inbound connections by default, thereby reducing the attack surface.
What are software firewalls and when are they required?
A software firewall is installed on the device itself (e.g., Windows Firewall). When a device operates on untrusted or public networks, a software firewall is required on that host if the network boundary can’t be controlled by the organization.
