Cyber Essentials Checklist for Small Businesses: What Do You Actually Need?

If a customer has asked for Cyber Essentials, your first job is to find out what your business actually uses and whether its basic protections are working. Buying a security product or starting the questionnaire will not answer that on its own.

Start with the scope, check the five controls below, then give each gap an owner and a way to verify the fix. That gives you something useful to work from when you complete the assessment.

This is a preparation checklist, not the complete assessment or a guarantee of certification. For new assessment accounts purchased from 27 April 2026, use the NCSC's Requirements for IT Infrastructure v3.3 and IASME's Danzell question set. If you already have an older assessment account, check IASME's version guidance rather than mixing question sets.

The five Cyber Essentials controls at a glance

Control	What you need to check
Firewalls	Internet connections are protected and unnecessary incoming access is blocked.
Secure configuration	Unneeded accounts, software and services are removed or disabled; devices are set up securely.
Security update management	Software is supported and qualifying vulnerability fixes are applied within 14 days of release.
User access control	Access fits each person's job, administrator accounts are separate, and available cloud MFA is used.
Malware protection	Each in-scope device has an appropriate, active method of protection against malicious software.

Cyber Essentials is a UK government-backed certification built around these five controls. It is a useful baseline for protection against common online threats, rather than a claim that every cyber risk has been removed. The NCSC's overview explains the scheme.

Start by agreeing what is in scope

Before answering technical questions, make a working list of the devices, software, accounts and cloud services used by the part of the business being assessed. Include home and remote working, rather than looking only at equipment in the office.

Check laptops, desktops, servers, phones, tablets and relevant network equipment. Record the operating-system and application versions, who uses each device and who looks after it. Include cloud services holding or providing your organisation's data or services, such as Microsoft 365 and your online accounts system. You cannot simply leave a relevant cloud service out because its settings are difficult to manage.

Personal devices need attention too. A phone used for work email is different from one used only for an MFA app or native calls and texts. If the business supplies a home router, that router is also in scope; other home routers are treated differently, while the work device still needs appropriate firewall protection.

Write down any proposed exclusions and check them against the official requirements. A scope with no end-user devices is not acceptable. Agree the scope with your chosen Certification Body before the assessment begins, resolving any unclear boundaries first.

Your asset list is a preparation tool, not a sixth Cyber Essentials control. Its purpose is to stop a forgotten laptop, personal device or cloud account undermining otherwise accurate answers.

1. Firewalls: check the rules, not just the equipment

A firewall controls traffic between your systems and the internet. Having one is only the starting point.

• Check that the required firewall protection is enabled, including on devices used away from the office.

• Block unnecessary incoming connections. Keep an approved business reason for any rule that allows them.

• Change default administrative passwords and remove old rules when their purpose has ended.

• Avoid exposing the management interface to the internet. If there is a genuine need, check the specific safeguards in the official requirements.

Useful preparation evidence includes the current configuration, the reason for permitted access and the person responsible for changes. An old supplier rule should be investigated, not assumed necessary because it has always been there.

2. Secure configuration: remove what you do not need

Devices and services often arrive with convenience features that your business does not use. Review the actual settings rather than assuming the default setup is suitable.

• Remove or disable unnecessary accounts, applications and services.

• Change default or easily guessed passwords.

• Require authentication before access to business information or services.

• Apply appropriate device-locking controls and restrict automatic execution of downloaded or removable-media content.

Keep a repeatable setup checklist for each device type, then verify that the devices in use still match it. The official requirements also set out password, unlocking and protection-against-guessing rules; this short checklist does not replace those details.

3. Security updates: make the deadline measurable

Check that all in-scope software is licensed and supported, including operating systems, applications, their components and router or firewall firmware. Enable automatic updates where possible. Unsupported software needs to be removed or replaced, or handled through the specific isolation requirements in the official standard.

The mandatory update rule is more precise than “keep everything current”. Apply vulnerability fixes within 14 days of release where any of these conditions applies:

• The vendor rates the vulnerability as critical or high risk.

• It has a CVSS v3 base score of 7 or above. CVSS is a system for rating vulnerability severity; your IT provider can check the vendor's advisory for the score.

• The vendor provides no details of the vulnerability's severity.

The clock starts when the fix is released, not when someone notices it. Apply fixes as soon as practical; day 14 is a limit, not a target. The NCSC recommends applying all released updates within 14 days, but that broader recommendation is distinct from the qualifying-fix requirement above.

Ask whoever manages updates to show which devices have completed them, which have failed and which have not checked in. A report saying most laptops are up to date is not enough to explain the missing one.

4. User access: check every relevant account

People should have their own authorised accounts and only the access their work needs. Check that leavers' access is removed, changed roles are reflected in permissions, and separate administrator accounts are used for administrative work rather than everyday email and browsing. Include third-party support accounts in the review.

For cloud services, use MFA wherever it is available, including where the provider charges for the option. IASME's April 2026 marking update makes clear that failing to implement available cloud MFA results in assessment failure. Do not treat a paid option as unavailable.

Check the service's actual enforcement settings and account coverage. Someone having an authenticator app, or registering a method, does not by itself prove that the relevant sign-ins require MFA. For the practical rollout work, see our small-business MFA rollout plan.

5. Malware protection: confirm it is active

Malware includes software designed to steal information, damage systems or gain unauthorised access. Check the appropriate protection method for each device type, rather than assuming one product covers everything.

• Confirm the required anti-malware protection or application controls are enabled and current.

• Check how untrusted applications are restricted and approved software is managed.

• Include remote and rarely used devices in the check.

Built-in protection may form part of the answer. Owning a Microsoft licence is not evidence that the relevant controls are configured and working. Keep the protection-status record alongside your device list so exceptions are visible.

Worked example: turning gaps into a preparation decision

Hypothetical example: an eight-person consultancy is preparing its first assessment. Its office manager gathers a list of eight work laptops, cloud services and user accounts. The IT provider reviews these against the full five-control requirements. The following two items remain open; the figures and dates are illustrative, not a Cache4 customer result.

Gap A: two cloud accounts are missing MFA

Evidence and finding, 12 October: the firm's scheduling service has six active user accounts. The administrator checks its account list and sign-in policy and finds that two accounts can still sign in without MFA, although the service offers it.

Owner and action: the service administrator owns the correction. The office manager arranges time with the two users to complete enrolment and checks that the required policy covers all six accounts, including any administrative access. The target is to complete and verify this on 13 October.

Recheck and recorded output, 13 October: the administrator confirms the policy coverage and tests the relevant sign-in behaviour. The preparation record reads: “Six active accounts checked; required MFA enforced; no unresolved account exceptions found. Checked by service administrator, 13 October.” Evidence is retained securely, without copying passwords or recovery codes into the checklist.

Gap B: an unsupported PDF application is on two laptops

Evidence and finding, 12 October: the application inventory and vendor lifecycle information identify the unsupported application on two devices.

Owner and action: the IT provider agrees to replace or remove it on both laptops and check the resulting software inventory. The office manager arranges access to the second laptop, which is away from the office.

First recheck, 13 October: only one laptop has been verified. The record stays open: “One device corrected; second device awaiting access and verification. Owner: IT provider. Recheck arranged for 14 October.” A planned fix is not recorded as completed.

Second recheck, 14 October: the provider verifies the correction on the remaining laptop and records both device identifiers, supported software versions and the check date. The office manager reviews the completed record against the full device list.

What does the owner decide?

On 13 October, the decision is to hold completion of the assessment answers because one known gap is unresolved. On 14 October, the owner can review the evidence for both corrections alongside the rest of the full-scope, five-control review, then complete accurate answers. An appropriately senior person must sign the required declaration.

Closing these two records does not itself award certification. The useful outcome is that the owner knows what was checked, what remains open and who is responsible. That reduces the risk of submitting answers based on assumptions or losing track of a fix between the business and its IT provider.

Cyber Essentials or Cyber Essentials Plus?

Both use the same five technical controls. Cyber Essentials uses an externally verified self-assessment; Cyber Essentials Plus adds an independent technical audit. Check the exact level required by any customer or contract. Our Cyber Essentials versus Cyber Essentials Plus guide explains the choice in more detail.

Certificates expire after 12 months, and the controls need to be maintained between assessments. The IASME certification FAQs explain the certification process and renewal.

Cyber Essentials is also only part of your wider security work. Backups, recovery testing, staff awareness and incident response still matter; backups are not one of the scheme's five technical controls.

What should you do next?

1. Agree the scope and gather the device, software, cloud-service and account lists.

2. Read the official requirements and download the question set that applies to your assessment account.

3. Work through all five controls with whoever manages your IT, recording evidence rather than relying on memory.

4. Give each gap an owner, an agreed action and a recheck. Keep unverified items open.

5. Review the full set of answers and supporting information before an appropriately senior person signs the declaration and you submit through your chosen Certification Body.

6. Keep the inventories and checks current, so preparation becomes part of normal IT management.

The NCSC's scheme overview and IASME's official question set are the starting points for detailed requirements.

Need help with the underlying IT?

Cache4 supports small businesses, start-ups and non-profits, mainly in Carlisle and Cumbria. Our cyber security service starts by reviewing Microsoft 365, devices and existing protection, then recommending suitable help and managing the work agreed with you.

Bring your scope and unresolved device or account gaps to a discovery call. We can discuss the practical IT work needed and whether our services fit. Preparation and technical support are separate from the independent certification assessment; any work and its scope need to be agreed.

Book a Free Discovery Call