Cyber Essentials: the five controls, and how we follow them

Cyber Essentials is the UK government-backed scheme, run by the National Cyber Security Centre and delivered through IASME, that certifies an organisation has five basic technical controls in place. Clients, insurers and public sector buyers ask for it more every year, and the latest update has made renewal meaningfully harder.

This page does two things. It explains what each control actually asks for, in plain English rather than scheme language. And it sets out how we apply the same five controls inside our own business, because a security company that cannot answer that question is not one you should hire.

What changed

Assessments are now made against version 3.3 of the NCSC requirements, in use since 27 April 2026 with the Danzell question set. Recent updates brought several things firmly into scope that smaller organisations were not evidencing before:

• Cloud services are in scope. Microsoft 365, Google Workspace, accounting and line-of-business software all count, including anything a single department signed up for without telling anyone. They cannot be excluded from scope.
• Home and remote-working devices are in scope. Anything used for work, wherever it is, including personally owned devices that touch company data.
• Multi-factor authentication is mandatory on every cloud service, for every user, not only administrators. Passkeys and other passwordless sign-in count.
• You need to know what you have. Asset management is not a control in its own right, but you cannot answer the questions honestly without a current list of your devices, software and cloud services.
• High and critical security updates within 14 days of release, for operating systems, apps, router and firewall firmware, and phones alike.

The common thread is evidence. It is no longer enough to say you do these things. You have to be able to show it, and the showing is where most of the work now sits.

The five controls, in plain English

Under each one: what the scheme asks for, and what we do about it in our own business. Where our answer is short, that is because the control is genuinely simple at our size, not because we have skipped it.

1. Firewalls

What it asks for. A firewall between your network and the internet, and the firewall built into every device switched on. Default administrative passwords changed. No services exposed to the internet unless there is a documented business case, and any that are, protected by an approved rule and a strong password or multi-factor authentication.

What we do. Device firewalls are enabled on every machine we use and are not left to individual discretion. We expose no inbound services from our office network: remote access runs over authenticated services rather than open ports, so there is no management interface sitting on the public internet waiting to be found. Anything we deploy for a client has its default credentials changed before it goes anywhere near a network.

2. Secure configuration

What it asks for. Devices and software set up deliberately rather than left at defaults. Unused accounts and applications removed. Default passwords changed. Auto-run disabled so untrusted code cannot execute on its own. Every device protected by a biometric, password or PIN of at least six characters, with repeated wrong guesses locked out or slowed down.

What we do. Machines are built from a standard configuration rather than set up ad hoc, so nothing depends on somebody remembering a step. Full disk encryption is on. Screens lock on inactivity. We run no shared logins for anything, which matters more than it sounds: a shared account is one you cannot revoke, audit or attribute.

3. User access control

What it asks for. A process for creating and approving accounts. Least privilege, so people hold only the access their role needs. Separate administrator accounts used only for administrative work, never for email and browsing. Multi-factor authentication on every cloud service, which since April 2026 is mandatory with no exceptions. Access removed promptly when someone leaves or changes role.

What we do. Every account is individual and attributable. Multi-factor authentication is on for every cloud service we use, without exception, because a partial rollout is the same as none for whichever account was missed. Administrative rights are held separately from day-to-day accounts. Where an engagement gives us access to a client system, that access is scoped to the work and removed when the work ends, rather than left in place in case it is useful later.

4. Malware protection

What it asks for. One of two approaches on every device: anti-malware software kept current and set to block malicious websites, or application allow-listing so only approved, signed software runs. Most organisations use anti-malware on computers and official app stores on phones.

What we do. Endpoint protection runs on every device, updates automatically, and is not something a user can quietly disable. We add DNS filtering on top, which stops a device reaching a known malicious domain even when something has already got past the first layer. Software is installed from vendor or platform sources rather than from search results.

5. Security update management

What it asks for. Only supported software, licensed and still receiving security updates from its vendor. Automatic updates enabled where available. Updates rated critical or high risk applied within 14 days of release, including on routers, firewalls and phones. Software that is no longer supported removed from the device.

What we do. Operating systems and browsers update automatically. High and critical patches are applied within the 14 day window rather than at a convenient moment. Unsupported software is removed rather than kept because it still works, which is the single most common thing we find in other people’s estates and would be embarrassing to have in our own.

Where we stand on certification

We are not currently certified to Cyber Essentials. We follow the five controls and we are willing to describe exactly how, which is what the rest of this page is, but we hold no certificate and we will not imply otherwise. Certification is issued by an accredited certification body after an assessment, not by a consultancy, and self-assessment is not the same thing.

We would rather say that plainly than let a badge do the implying. If your procurement process requires a supplier to hold the certificate, say so early and we will tell you honestly whether we meet the bar today.

Getting ready for yours

Staying certified after the first year

Most firms pass the first time and then struggle at renewal, because the estate moves and the evidence does not. A laptop joins without the standard build. Someone signs up for a new cloud tool. A machine falls off the patch schedule and nobody notices for four months. None of it is negligence, it is just what happens when nobody owns the question.

Three things make renewal ordinary rather than a scramble. Keep a current list of devices and cloud services, because you cannot evidence what you cannot enumerate. Check multi-factor authentication coverage periodically rather than assuming it, since new accounts are where gaps appear. And keep the evidence as you go, so the questionnaire is a transcription job rather than an investigation.

If you would rather someone owned it, that is part of what a retained security lead does.

Last reviewed 21 October 2026, against the NCSC Cyber Essentials requirements v3.3. Questions about anything here: info@secureselect.co.uk.

Not sure where you stand? Take the free security check. It asks a few non-technical questions and tells you which of these controls you are likely to fail on today.