Quick answer: A Cyber Essentials checklist covers five controls: firewalls, secure configuration, security updates, user access control and malware protection. Before you apply, list every device and cloud service in scope, install high and critical updates within 14 days, turn on multi-factor authentication for every cloud service and remove unsupported software.
Cyber Essentials is the UK government-backed scheme that shows you have the basic technical controls in place against common online attacks. This Cyber Essentials checklist turns the official requirements into plain questions a practice manager, care home owner or charity trustee can work through before paying for an assessment. Every rule below was checked against the NCSC’s Cyber Essentials: Requirements for IT Infrastructure, version 3.3 (April 2026) on 20 October 2026.
What does a Cyber Essentials checklist need to cover?
It needs to cover everything in scope first, then the five controls on each item. Start with an honest list:
- Devices: every laptop, desktop, tablet and phone that accesses your organisation’s email or data, including the reception PC that “just does bookings”.
- Cloud services: email, file storage, practice or care management systems, accounting and HR tools. As our guide to the 2026 Danzell question set explains, cloud services can no longer be excluded from scope.
- Network kit: your router or firewall, and any separate firewall software on devices.
- Accounts: who has a login to what, and which accounts have administrator rights.
If you skip this step, the rest of the checklist is guesswork. A device or account nobody remembered is an easy way to fail.
Firewalls: what do you need to check?
Check that every internet connection is protected by a firewall that you control. The NCSC requirements ask you to:
- change the default administrator password on your router or firewall to a strong, unique one, or turn off remote administration entirely;
- block internet access to the admin interface unless there is a documented business need, and then protect it with multi-factor authentication or an allow list of IP addresses;
- block unauthenticated inbound connections by default, and make sure any inbound rules are approved and documented by an authorised person.
Secure configuration: what counts as a secure set-up?
A secure set-up means devices have only what they need and nothing guessable. Work through each device and:
- remove or disable software, utilities and services you do not use;
- change any default or guessable account passwords;
- turn off auto-run, so files cannot run without someone allowing it;
- set a screen lock. Where a PIN or password only unlocks the device, it must be at least 6 characters, and the device must lock after no more than 10 failed attempts, or limit guesses to no more than 10 in 5 minutes.
Security updates: how quickly do you need to patch?
You need to install high-risk and critical security updates within 14 days of release. The requirements define these as updates the vendor rates “critical” or “high risk”, or that fix vulnerabilities with a CVSS v3 base score of 7 or above. Alongside that:
- all software must be licensed and supported, and removed when it stops being supported;
- automatic updates should be switched on wherever possible.
The practical check: look for old operating systems, an unsupported version of office software, or a forgotten browser plug-in. One out-of-date device can be enough to fail.
User access control: what are the password and MFA rules?
Everyone needs their own login, admin rights need their own separate account, and every cloud service must use multi-factor authentication (MFA). The detail from version 3.3:
- have a process to create and approve user accounts, and give each person unique credentials;
- use separate administrator accounts only for admin tasks, not for email or browsing;
- where a password is used with MFA, it must be at least 8 characters with no maximum length;
- without MFA, passwords must be at least 12 characters, or at least 8 with a block list of common passwords;
- authentication to cloud services must always use MFA.
If shared logins are still common in your team, start there. Our guide to MFA for small teams shows how to switch it on without locking anyone out.
Malware protection: anti-malware or allow listing?
Every in-scope device must use at least one of two options: anti-malware software (for Windows and macOS devices) or application allow listing, where only approved apps can run. For most small offices, the built-in protection on a supported, updated version of Windows or macOS, switched on and kept current, is the usual starting point. Check it is actually on.
Where should a small team look twice before applying?
Gaps tend to hide in the same few places, so these are worth a second look:
- a cloud service set up years ago by someone who has since left, still without MFA;
- a shared “admin” login used for day-to-day work;
- a home router or personal phone used for work that nobody has checked;
- an old PC kept for one piece of software that no longer gets updates.
Once these are clear, read Cyber Essentials vs Cyber Essentials Plus to decide which level you need, and what Cyber Essentials costs in 2026 to budget for it.
FAQs
How long does it take to work through this checklist?
For a small organisation with a handful of laptops and one or two cloud services, a careful check usually takes a few hours spread over a week or two. Most of that time goes on finding every device and account, and waiting for updates to install.
Do staff phones count for Cyber Essentials?
Phones and tablets that access your organisation’s email or data are part of what the assessment looks at, so include them in your device list. Check they are on a supported version, lock with a PIN and receive updates.
Can we do Cyber Essentials ourselves?
Yes. Cyber Essentials is a self-assessment that a certification body then marks. Many small organisations complete it themselves; others get help with readiness first so the answers are accurate before they apply.
Does Unavoidably Secure issue Cyber Essentials certificates?
No. We help you get ready by checking your controls and giving you a plain-English list of what to fix. The certificate itself is issued by an IASME certification body after it marks your assessment.
How we can help
Unavoidably Secure offers Cyber Essentials readiness: we review your devices, accounts, website and email security against the five controls and give you a plain-English list of what to fix first, written for small teams. We do not certify, accredit or guarantee compliance. Certificates are issued by IASME certification bodies.
This checklist is general information, not legal advice, and it does not replace the official question set. Facts were checked against the NCSC’s Requirements for IT Infrastructure v3.3 on 20 October 2026. For the basics in one place, read our plain-English guide to Cyber Essentials, or browse the blog.
Want to know if you would pass?
Book a free external audit. We will review your website, email security and the basics an assessor looks for, and give you a plain-English list of what to fix first.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.