Cyber Essentials Checklist for Small Businesses: What Do You Actually Need?
Cyber Essentials can look like a technical questionnaire, but the aim is much simpler: make sure the basic protections that stop many common cyber attacks are properly in place across your organisation. This Cyber Essentials checklist is designed to help a small business understand what to check before starting the certification process.
The current Cyber Essentials Requirements for IT Infrastructure are version 3.3, effective from 27 April 2026. The scheme still centres on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
This guide is a practical preparation aid rather than a replacement for the official assessment questions. The exact answers will depend on your own devices, users, cloud services and network.
Cyber Essentials checklist: the five controls at a glance
Area | What to check |
1. Firewalls | Internet connections are protected, unnecessary inbound access is blocked and administrative access is appropriately secured. |
2. Secure configuration | Default or unnecessary accounts, software and services are removed or disabled, and devices are configured securely. |
3. Security update management | Operating systems, applications and devices are supported and security updates are applied within the required timescales. |
4. User access control | People have their own accounts, permissions match their jobs, admin access is restricted and multi-factor authentication is used where required. |
5. Malware protection | Devices use suitable malware protection or application controls and users are protected from running untrusted software. |
What is Cyber Essentials?
Cyber Essentials is a UK Government-backed cyber security certification designed to protect organisations against many of the most common online threats. The National Cyber Security Centre describes the scheme around five technical controls that organisations need to have in place. You can read the official Cyber Essentials overview if you want the scheme definition and certification routes.
For a small business, the value is not simply the certificate. Working through the requirements can expose weak points such as unsupported software, unnecessary administrator access, missing multi-factor authentication or devices that have never been properly included in the security picture.
Cyber Essentials should therefore be treated as a strong security baseline, not as proof that every cyber-security risk has disappeared. That wider distinction matters when you think about small-business cyber security.
Before you start: get the scope right
A common mistake is to jump straight into the questions before deciding exactly what the assessment covers. The 2026 requirements put particular emphasis on getting this scope clear.
Identify the end-user devices used to access organisational data or services. A scope with no end-user devices is not acceptable.
Identify the cloud services that store your organisation’s data or provide services to it. Under the current requirements, relevant cloud services cannot simply be excluded from scope.
Know which networks, servers, laptops, desktops, phones, tablets and other relevant devices form part of the assessment.
If anything is excluded, make sure the exclusion is justified and that excluded networks are properly separated from the systems that are in scope.
Keep a usable record of your assets. Asset management is not one of the five named controls, but it makes it much easier to apply all five consistently.
For a business using Microsoft 365, that means cloud identity, email, files and access controls need to be considered as part of the real environment rather than treated as something separate from IT security.
1. Firewalls: control what can reach your devices and network
A firewall acts as a filter between your systems and the internet. The important point is not simply whether a firewall exists, but whether it is configured so that only the access your business genuinely needs is allowed.
Check that:
firewall protection is enabled where required;
unnecessary incoming connections and services are blocked;
internet-facing administration is not left openly accessible;
any firewall rules you have added are still needed;
default passwords on routers, firewalls or network devices have been changed.
If somebody opened a firewall rule several years ago for an old application or supplier, it is worth checking whether that exception is still required.
2. Secure configuration: remove the easy ways in
New computers, software and network devices are not always secure straight out of the box. They can include default accounts, unnecessary applications, services you do not use or settings designed for convenience rather than security.
Check that:
unused or unnecessary user accounts are removed or disabled;
default and easily guessed passwords have been changed;
software, utilities and network services that are not needed have been removed or disabled;
devices require users to authenticate before accessing organisational information;
device locking is configured appropriately;
features that automatically run downloaded or removable content are controlled.
The aim is straightforward: if your business does not need a feature, account or service, do not leave it available for an attacker to use.
3. Security update management: keep supported software up to date
Cyber criminals regularly exploit known weaknesses in operating systems, applications and devices. Once a security problem is known and a fix is available, leaving that fix unapplied gives attackers an opportunity that can often be avoided.
Check that:
your operating systems and applications are still supported by their manufacturers;
security updates are installed within the timescales required by Cyber Essentials;
automatic updates are enabled where they are suitable;
firmware and network-device updates are not forgotten;
software that can no longer be securely updated is removed or replaced.
For a small business, one old laptop or forgotten application can be enough to create a problem. The assessment is about the environment that actually exists, not only the newest devices.
4. User access control: give people only the access they need
User access control is about making sure the right people can get to the right information, without giving everybody more privileges than their job requires.
Check that:
each person has an individual account rather than sharing a general login;
accounts are removed or disabled when people leave;
standard users do not routinely work with administrator privileges;
administrator accounts are used only for tasks that genuinely need them;
multi-factor authentication is enabled where the Cyber Essentials requirements call for it, including relevant cloud services;
permissions are reviewed when roles change.
The 2026 scheme update places stronger emphasis on multi-factor authentication and modern authentication methods. If Microsoft 365 is central to your business, identity and access settings are therefore an important part of preparation.
The licence you use can also affect the security controls available to you. Our guide to Microsoft 365 Business Basic vs Standard vs Premium explains some of those differences in plain English.
5. Malware protection: stop malicious software from running
Malware includes malicious software such as viruses, ransomware and other code designed to damage systems, steal information or give an attacker access.
Check that:
devices use appropriate and supported malware protection;
malware protection is kept active and up to date;
users cannot freely run untrusted applications where application controls are being used;
only trusted applications and software sources are permitted;
protections apply consistently to the devices in scope.
For many modern Windows environments, built-in Microsoft security capabilities may form part of the answer, but simply owning security technology does not prove it is configured or managed correctly.
Common gaps to check before you start the assessment
Before opening the assessment portal, it is worth checking for some of the practical gaps that can make the process harder:
old laptops or computers running unsupported operating systems;
software that is no longer supported or updated;
administrator accounts that are used for everyday work;
accounts belonging to people who have left;
shared user accounts where individual accounts should be used;
multi-factor authentication that is available but has not been enabled;
cloud services nobody remembered to include in the scope;
personal or unmanaged devices accessing business information;
unnecessary services, applications or firewall rules left in place;
inconsistent patching because nobody is clearly responsible for updates.
Finding one of these does not mean certification is out of reach. It means you have identified something useful to correct before submitting the assessment.
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials and Cyber Essentials Plus are based on the same technical controls, but the level of verification is different.
Cyber Essentials uses a verified self-assessment. Your organisation answers the assessment questions and the submission is reviewed as part of the certification process.
Cyber Essentials Plus adds independent technical testing to verify that the controls are working in practice.
If a customer, contract or supply chain specifically requires Cyber Essentials Plus, make sure you plan for the additional technical assessment rather than assuming the standard self-assessment is enough.
Does Cyber Essentials mean your business is fully secure?
No security certification can remove every risk, and Cyber Essentials is deliberately focused on a defined set of common technical attacks.
A small business may still need to consider areas such as email security, backups, staff awareness, password management, incident response, monitoring and recovery. Cyber Essentials works best as part of a wider security approach rather than as a one-off certificate that is forgotten after the assessment.
That is why Cache4 treats cyber security as the protection layer around the Microsoft 365 foundation, before ongoing IT support and wider use of AI services.
What should you do next?
Confirm the systems, devices, users, networks and cloud services that are in scope.
Read the current Cyber Essentials Requirements for IT Infrastructure v3.3.
Download the current assessment questions and work through them before buying or submitting certification.
Use the official Cyber Essentials Readiness Tool to identify gaps.
Correct the gaps you find and make sure the controls are applied consistently.
Decide whether a self-led certification route is appropriate or whether you need supported certification.
The NCSC provides the current requirements, assessment questions and Readiness Tool on its Cyber Essentials resources page. That should be your source of truth for the scheme itself.
Need help strengthening your cyber security before you start?
Cyber Essentials is easier when the basics are already properly managed. If you want help reviewing your Microsoft 365 environment, devices, security settings and wider cyber-security foundations, Cache4 can help you understand what needs attention.
We work with small businesses and organisations in Carlisle and across Cumbria, keeping security practical and avoiding unnecessary complexity.
Comments