Cyber Essentials readiness checklist

Work through the requirements before you apply, and see exactly where the gaps are.

By Jason Kelly, Certified ISO/IEC 27001 Lead Implementer. Last reviewed October 2026.

Written against the current version: NCSC Requirements for IT Infrastructure v3.3 and the IASME Danzell question set, which apply to assessments started from 27 April 2026.

This is a preparation aid, not the official questionnaire, and it does not guarantee certification. It is general guidance, not legal or professional advice. Always check your answers against the NCSC requirements and the IASME question set.

0 of 37 checks complete

Your ticks are saved in this browser only. Nothing is sent to us.

Scope

Decide what the certificate covers before you check anything else.

You have decided whether the whole organisation is in scope, or a clearly separated part of it (and can explain why).Laptops, desktops, tablets and phones used for work are included. A scope without end-user devices is not accepted.Every cloud service that holds or processes your data (Microsoft 365, Google Workspace, Xero, Dropbox and so on) is listed. Cloud services cannot be left out.Personal devices that access work email, files or apps are included, apart from phones used only for calls, texts or MFA codes.Home and remote workers’ devices are included, along with any router you have given them.Accounts used by IT suppliers or managed service providers to look after your systems are included.

1. Firewalls

Only the network services you need should be reachable from the internet.

Every in-scope device sits behind a firewall: your office router or firewall, or the software firewall on the device itself.Default admin passwords on routers and firewalls have been changed to strong, unique ones, or remote admin is switched off.The firewall admin page cannot be reached from the internet, unless there is a documented need and it is protected by MFA or an IP allow list.Unsolicited inbound connections are blocked by default.Every inbound rule has been approved by a named person, with the business reason written down.Old or unused firewall rules have been removed.Laptops used on public Wi-Fi have their built-in software firewall switched on.

2. Secure configuration

Remove what you don’t need and lock down what you keep.

Unused accounts, including guest and spare admin accounts, have been removed or disabled.Default and easily guessed passwords have been changed on every device and service.Software, utilities and services that aren’t needed have been removed or disabled.Auto-run is off, so downloaded files and inserted media can’t run without the user choosing to.Users must sign in before they can reach any company data or service.Devices need a PIN, password or biometric to unlock, with a PIN or password at least 6 characters long.Unlocking is protected against guessing: the device locks after no more than 10 wrong attempts, or slows down repeated attempts.

3. Security update management

Known vulnerabilities must be fixed quickly.

All software on in-scope devices is properly licensed and still supported by the vendor, including operating systems and router or firewall firmware.Unsupported software (for example an old version of Windows) has been removed, or moved into a separated area with no internet access.Automatic updates are switched on wherever they are available.Updates rated critical or high risk (CVSS 7 or above), or with no rating given, are installed within 14 days of release.

5. Malware protection

Stop malicious software arriving and running.

Every in-scope Windows and macOS device has active anti-malware protection (built-in tools such as Microsoft Defender count).Anti-malware is kept up to date, blocks malware from running, and blocks access to known malicious websites.Any devices protected by application allow listing instead only run approved, correctly signed apps, and users can’t install anything else.

Recommended, but not required

Backups are not a Cyber Essentials requirement, but version 3.3 puts much more emphasis on them. They are your recovery plan if ransomware gets through.

Automatic backups are switched on for important data.
At least one backup copy is kept separate from your network, for example disconnected storage or a separate cloud account.
You have test-restored a backup in the last six months.

What changed in April 2026

Cloud services are formally defined and can no longer be excluded from scope.
MFA on cloud services is now strictly enforced.
Passkeys and FIDO2 security keys are recognised as passwordless sign-in and count as MFA.
Any part of your organisation you leave out of scope must be justified to the assessor.
Backups are given more prominence, though they remain a recommendation.

Book a readiness review

Important

This checklist is provided free as general information. It is a preparation aid based on the NCSC Cyber Essentials Requirements for IT Infrastructure v3.3. It is not the official question set, it does not guarantee certification, and it is not legal or professional advice. Requirements change each year; always check the current official documents before you apply. To the extent permitted by law, Cyber Ascent Consultancy Limited accepts no liability for any loss arising from use of this checklist. See our terms of use.