Cyber Essentials Controls
The Cyber Essentials scheme defines five key technical controls that every UK organisation should implement to protect against common cyber‑attacks. These controls apply regardless of organisation size or industry and cover devices used in the office, at home or remotely (including BYOD and cloud services). The controls help you reduce risk without unnecessary complexity and form the basis for Cyber Essentials and Cyber Essentials Plus certification.
Summary of the Five Controls
Control |
Purpose |
Examples |
|
Firewalls |
Restrict inbound and outbound network traffic so that only necessary and secure services are exposed. A firewall (hardware device, software firewall or cloud policy) creates a protective boundary around your systems. |
Change default passwords, block unwanted traffic, document and review firewall rules. |
|
Secure configuration |
Ensure computers and network devices are configured safely from the start. Default settings often include unnecessary services or accounts, which attackers exploit. |
Remove unused accounts and software, disable auto‑run and set strong device lock controls. |
|
Security update management |
Keep operating systems, firmware and applications up to date. Vendors release patches to fix vulnerabilities; failing to apply them leaves systems exposed. |
Use supported software, enable automatic updates and install critical or high‑risk patches within 14 days. |
|
User access control |
Make sure only authorised people have user accounts and that those accounts provide only the access needed for their job. Strong authentication reduces the chance of accounts being misused. |
Approve account creation, use unique credentials, enable multi‑factor authentication and promptly remove unused accounts. |
|
Malware protection |
Prevent malware and untrusted software from running on devices. |
Use anti‑malware software or application allow‑listing; keep definitions up‑to‑date and block malicious websites. |
Firewalls and Network Boundary Security
Firewalls are your first line of defence. They inspect and filter network traffic so that only permitted connections are allowed. A properly configured firewall reduces your exposure to attacks by blocking unauthorised access and restricting services to what the business genuinely needs. Firewalls can be hardware devices at your network boundary, software firewalls on individual devices or cloud‑based data‑flow policies.
Minimum actions
- Deploy a firewall for every device in scope – Use a boundary firewall or enable the built‑in software firewall on laptops, desktops and servers. Cloud services should use data‑flow policies to achieve the same effect.
- Change default passwords and restrict admin access – Replace factory‑set admin passwords with strong, unique credentials and disable remote management interfaces unless genuinely needed. If remote administration is required, protect the interface using multi‑factor authentication or an IP allow‑list.
- Block unauthenticated inbound connections by default – Deny all unsolicited inbound traffic and only open the ports/services you need. Each rule should be documented and approved by someone responsible for security.
- Remove unnecessary rules – Regularly review firewall rules and remove any that are no longer required.
- Keep firmware up to date – Apply any critical or high-risk security updates to firewalls and boundary devices within 14 days of release.
- Use software firewalls when off‑network – Ensure laptops and other portable devices have their software firewalls enabled when connecting to untrusted networks (e.g., public Wi‑Fi).
Enhanced measures
- Network segmentation – Divide your network into smaller segments separated by internal firewalls or VLANs. NHS guidance notes that segmentation limits the “blast radius” of an attack by containing traffic within each segment and reducing the attack surface. Only allow authorised traffic between segments and block everything else.
- Centralised firewall management – Use a central management tool to push consistent rules to all firewalls and record changes. Maintain a firewall access register to document who can modify rules and why.
- Intrusion detection and logging – Enable logging on your firewall and regularly review logs for suspicious activity. Consider deploying an intrusion detection/prevention system (IDS/IPS) to monitor and alert on unusual traffic patterns.
- Regular audits and testing – Schedule periodic firewall configuration reviews and external vulnerability scans (required for Cyber Essentials Plus) to ensure the firewall still meets business needs and that critical firmware updates are applied. Conduct simulated attacks to verify that only intended services are reachable.
- Advanced threat protection – Larger organisations may invest in next‑generation firewalls with features such as deep‑packet inspection, application awareness and threat intelligence feeds. These tools provide greater visibility and automated blocking of known malicious traffic. While not required for Cyber Essentials, they offer additional protection where budget allows.
Firewalls & Network Security: Frequently Asked Questions
Secure Configuration
Devices come with default settings intended for ease of use rather than security. These settings may include default passwords, unnecessary user accounts or services and features like auto‑run, all of which create vulnerabilities. Secure configuration means hardening each device so it only runs what it needs and is locked down against common attacks.
Minimum actions
- Mobile Encryption (Mandatory) – Ensure encryption is enabled on all mobile devices (smartphones/tablets). For most modern devices, this is active by default once a PIN or password is set.
- Remove unnecessary user accounts and privileges – Delete guest accounts and disable default or administrative accounts that are not used. Assign users the minimum privileges they need to perform their job.
- Change default or guessable passwords – Replace vendor‑provided passwords on all devices and applications with strong, unique credentials.
- Segregation of admin and standard accounts – Separate administrator account function from that of standard accounts used for everyday tasks such as browsing the web or reading email. For example, IT staff should have two accounts, one they log into for normal day-to-day use and a separate admin account for IT support.
- Remove unused software and services – Uninstall any application, system utility or network service that is not needed. Fewer services means fewer potential vulnerabilities.
- Disable auto‑run features – Prevent files from executing automatically when downloaded or inserted (e.g., via USB).
- Implement device locking controls – Require users to authenticate (via password, PIN or biometrics) before accessing a device. To prevent brute-force attacks, devices must be configured to lock or provide a progressive delay after no more than 10 failed attempts.
- Document and repeat – Use a checklist when provisioning devices so that hardening steps are consistently applied. Record configurations so you can rebuild devices quickly if needed.
Enhanced measures
- Configuration baselines and automation – Develop a secure baseline configuration for each device type (server, workstation, mobile, router) and use automated tools such as Group Policy, MDM or configuration management platforms to apply them consistently across your estate. Regularly review baselines to incorporate new vendor guidance.
- Enable disk encryption for laptops and desktops – While mandatory for mobiles, extending full-disk encryption (e.g., BitLocker for Windows, FileVault for macOS) to all portable computers is a critical best practice to protect data at rest if a device is lost or stolen.
- Secure build pipelines – For cloud and virtual environments, use infrastructure‑as‑code and container hardening to ensure that instances are deployed with secure settings from the outset. Apply the principle of least privilege to API keys and service accounts.
- Configuration scanning and drift detection – Deploy vulnerability scanners or configuration assessment tools to identify insecure settings (e.g., weak protocols, open services). Address deviations from your baseline promptly.
- Segregation of administrative functions – Use dedicated management networks or jump servers for system administration.
Secure Configuration: Frequently Asked Questions
Security Update Management (Patch Management)
Software vulnerabilities are discovered all the time. Vendors release patches or configuration changes to fix them, but attackers often exploit unpatched systems very quickly. Security update management ensures your systems are running supported software and that fixes for high‑risk vulnerabilities are applied in a timely manner.
Minimum actions
- Use licensed, supported software – Only use operating systems and applications that are still supported by the vendor. Remove unsupported software from the network or isolate it within a separate, firewalled sub‑set.
- Enable automatic updates – Configure devices and applications to install updates automatically whenever possible.
- Apply high/critical security updates within 14 days – Install patches or other vendor‑approved fixes within 14 days of release when they:
- fix vulnerabilities described by the vendor as critical or high risk or with a CVSS v3 base score of 7 or above,
- or when the vendor provides a fix but does not specify severity.
Note that vendors sometimes bundle fixes for vulnerabilities of differing severities; if any part of the update addresses a high‑risk issue, apply it within 14 days.
- Maintain an up‑to‑date inventory – Keep an asset register of all devices, operating system versions and installed software so you know what needs to be patched.
- Remove or isolate unsupported software – If you cannot patch a piece of software (because it is obsolete or bespoke), isolate it on a segregated network or remove it from scope.
Enhanced measures
- Automated patch management tools – Use dedicated patch management platforms or endpoint management solutions to automate update distribution, reporting and compliance tracking.
- Risk‑based prioritisation – Classify assets based on importance and exposure; prioritise patching for internet‑facing systems and critical business applications. Consider accelerating patches outside the 14‑day window when there is evidence of active exploitation.
- Testing and staged deployment – For critical systems, test patches in a staging environment before organisation‑wide deployment to ensure they do not disrupt operations. Rolling deployment reduces the risk of widespread outages.
- Vulnerability scanning and continuous monitoring – Regularly scan your network and cloud services to detect missing patches or misconfigurations. Continuous monitoring helps identify devices that fall out of compliance so they can be remediated quickly.
- Formal patching policy – Document who is responsible for applying patches, the process for emergency updates and the escalation route when patches cannot be applied within the recommended timeframe.
Security Update Management: Frequently Asked Questions
User Access Control
Every user account provides a way into your systems. Unused or excessively privileged accounts increase the risk of compromise. User access control ensures that accounts are created only for authorised individuals, that they have just enough permissions to perform their role and that strong authentication protects them.
Minimum actions
- Establish a process for account creation and approval – Only create accounts for authorised users and document who approved the account.
- Use unique credentials for each user – Never share user accounts; unique usernames and passwords allow activity to be attributed to individuals.
- Promptly disable accounts no longer required – Remove access when staff leave or change roles, or after a defined period of inactivity.
- Implement multi‑factor authentication (MFA) – Require MFA wherever it is available, particularly for cloud services and administrative accounts. MFA provides additional protection against credential theft.
- Use separate administrative accounts – Do not perform day‑to‑day activities such as browsing or email from an account with special privileges. Restrict privileged accounts to administrative tasks only.
- Control password quality and protect against brute force – Enforce minimum password lengths (12 characters where MFA isn’t used or at least 8 characters with deny‑lists when MFA is used) and implement account lockout or throttling after multiple failed attempts. Avoid mandatory password complexity rules or regular forced changes.
Enhanced measures
- Centralised identity management – Implement directory services (e.g., Microsoft Entra ID/Azure AD) or identity‑as‑a‑service solutions to manage accounts, enforce MFA policies and provide single sign‑on (SSO) across cloud services. Such services simplify onboarding and offboarding, and enable conditional access based on device health and location.
- Password managers and passphrase policies – Encourage users to create strong, memorable passphrases using three random words and store them in a secure password manager. Provide guidance on avoiding easily guessed words and re‑used passwords. Modern password policies should focus on length and uniqueness rather than arbitrary complexity rules.
- Adopt passwordless authentication – Where possible, implement passwordless methods such as biometrics, security keys or trusted-device push notifications, as recognised in the Cyber Essentials v3.2 update. Passwordless approaches reduce reliance on secrets that can be phished.
- Regular access reviews – Periodically review user permissions and group memberships to ensure they remain appropriate. Remove “standing” administrative rights in favour of just‑in‑time privileged access for tasks requiring elevation.
- User training and awareness – Educate staff about phishing, credential theft and social engineering. Simulated phishing exercises and regular reminders help reinforce good habits.
User Access Control: Frequently Asked Questions
Malware Protection
Malware includes viruses, worms, ransomware and other malicious software that can damage systems, steal data or facilitate further attacks. Cyber Essentials requires you to restrict the delivery and execution of malware on all devices. You can meet this requirement through anti‑malware software or by implementing application allow‑listing.
Minimum actions
- Use anti‑malware software or application allow‑listing – On Windows and macOS systems, install anti‑malware software that is kept up‑to‑date and configured to block known malware, prevent the execution of malicious code and stop connections to known‑malicious websites. Alternatively, use application allow‑listing so that only approved, signed applications can run.
- Keep malware definitions up to date – Configure your anti‑malware solution to update automatically in line with vendor recommendations.
- Prevent malware delivery – Use email filtering and web protection to block malicious attachments and websites. Disable or restrict macros and script execution where possible.
- Maintain an approved software list – Actively approve applications before deployment and maintain a list of approved software. Users must not be able to install unsigned or unapproved applications.
- Ensure full coverage – Deploy malware protection on all in‑scope devices, including servers, desktops, laptops, tablets, smartphones and cloud workloads.
Enhanced measures
- Endpoint detection and response (EDR) – Upgrade from basic anti‑virus to EDR solutions that use behavioural analysis and machine learning to detect and respond to unknown threats. EDR platforms provide central visibility across endpoints and support rapid containment.
- Application control and sandboxing – Use application control to restrict which executables, scripts and libraries can run. For high‑risk environments, sandbox suspicious attachments and links to observe behaviour before allowing them onto the network.
- Threat intelligence and network monitoring – Subscribe to threat‑intelligence feeds and integrate them into your malware defences. Monitor network traffic for indicators of compromise and unusual patterns.
- Backups and recovery – Although not a requirement, the NCSC strongly recommends having regular, offline backups so you can recover quickly if ransomware or destructive malware strikes.
- User awareness and phishing simulation – Train users to recognise phishing emails and malware delivery techniques; run regular simulations to reinforce skills.