Cyber Essentials Requirements: A Plain-English Checklist

If you are preparing for certification, the Cyber Essentials requirements are shorter and more specific than most people expect. Five technical controls, applied to every in-scope device and cloud service, decide whether you pass.

The difficulty is rarely the controls themselves. It is scope, multi-factor authentication and patching discipline, because these are where assessors find gaps. The latest version of the rules has also made some of those gaps an automatic fail.

This guide walks through the current Cyber Essentials requirements in plain English, with a practical Cyber Essentials checklist you can work through before you open the Cyber Essentials questionnaire. It reflects the NCSC requirements document (v3.3) and the NCSC Cyber Essentials overview. If you want the wider process first, start with our Cyber Essentials certification guide.

What the Cyber Essentials requirements actually cover

Cyber Essentials is the UK government-backed baseline scheme, delivered by IASME on behalf of the NCSC. The requirements are published in a document called Requirements for IT Infrastructure. It sets out what must be true of your devices, networks, accounts and cloud services on the day you are certified.

The scheme is built around five technical controls:

• Firewalls: a filter between your devices and the internet.
• Secure configuration: devices and software set up to reduce easy ways in.
• Security update management: software kept supported and patched.
• User access control: the right people, with the right level of access.
• Malware protection: detecting and stopping malicious code.

Certification is for the organisation as a whole, or a clearly defined and separately managed part of it. IASME states that the certificate is valid for 12 months, so you will repeat the process every year.

Which version applies now, and what changed

The current document is version 3.3, known as Danzell. It replaced version 3.2 (Willow). According to the SureCloud summary of the v3.3 changes, the Danzell question set applies to assessment accounts created on or after 27 April 2026. If you started an assessment earlier, check with your certification body which question set you are on.

The five controls themselves have not changed. What has changed is the wording around scope and the consequences of getting things wrong. The main differences from v3.2 are:

The v3.2 release in April 2025 had earlier introduced passwordless guidance and renamed "home working" to "home and remote working". Check the NCSC site for the latest document before you start, because versions are updated roughly annually.

The five technical controls in plain English

Here is what each of the five technical controls asks for, based on the NCSC requirements document (v3.3).

1. Firewalls

Every in-scope device needs a correctly configured firewall, either a hardware firewall at the network edge or a software firewall on the device itself. Default administrator passwords must be changed, or remote administration switched off. Unauthenticated inbound connections should be blocked by default, and any inbound rule needs an approved, documented business reason.

2. Secure configuration

Remove or disable accounts and software you do not need, including guest accounts and unused admin accounts. Change default passwords. Disable auto-run features. Lock devices when the user steps away, and limit password guessing on devices to no more than 10 attempts in 5 minutes, or lock after no more than 10 failures.

3. Security update management

All software must be licensed and supported. Anything unsupported must be removed, or isolated from the internet entirely. Updates that fix critical or high-risk vulnerabilities (vendor rating high or critical, or a CVSS v3 score of 7 or above) must be applied within 14 days of release. Our Windows 10 end-of-support guide explains why this catches out many businesses.

4. User access control

Accounts need an approval process and unique credentials. Remove them promptly when someone leaves. Admin tasks must use a separate admin account that is never used for email or browsing. Multi-factor authentication applies, and is mandatory for cloud services.

5. Malware protection

Every in-scope device needs anti-malware that is kept up to date, stops malicious code running and blocks malicious websites, or an application allow list limited to approved, code-signed software.

A practical Cyber Essentials checklist

Use this Cyber Essentials checklist as a pre-assessment sweep. If you cannot answer yes to every line, that is your work list.

Multi-factor authentication rules

Multi-factor authentication (MFA) is the area where most applicants need to change something. The rules in the current version are straightforward:

• MFA must be used wherever it is available, and always for cloud services.
• It should also protect administrative accounts and any account accessible from the internet.
• The password element of MFA must be at least 8 characters, with no maximum length.
• Acceptable extra factors include an app on a trusted device, a managed device, a physically separate token or a known trusted account.
• SMS codes are the weakest option. They still count, but an authenticator app or security key is better.
• FIDO2 passkeys and security keys are accepted as MFA.

If you cannot use MFA on an account, the password rules apply instead. You need brute-force protection, plus either a minimum of 12 characters, or 8 characters with a deny list of common passwords. Do not force regular password changes, and do provide a password manager.

Scope: BYOD, cloud services and home working

Scope mistakes are a common reason applicants fail, because they either leave things out or never find them. The NCSC requirements document (v3.3) is specific:

Where a corporate VPN is used, the internet boundary sits at the company or cloud firewall. Employee BYOD is in scope, while student BYOD is not. Whatever you exclude, you will need to justify it to your assessor.

Meeting the requirements with Microsoft 365 and Intune

Most NetMonkeys customers run on Microsoft 365, and much of the scheme can be met with tools they already license. Which ones depend on your plan, so check this against your own licences. Our Microsoft 365 support team sets these up regularly.

Intune also gives you evidence. A compliance report showing every device is patched and protected is far easier to defend than a spreadsheet kept by hand. If you want help preparing, see our Cyber Essentials service. NetMonkeys supports preparation and remediation, while the assessment itself is carried out by a certification body.

Why Cyber Essentials fails: the common reasons

When people ask why Cyber Essentials fails, the answer is usually a handful of recurring gaps rather than anything exotic.

• Unsupported software. Old Windows versions, unsupported browsers and end-of-life routers or firewalls are the classic cause.
• Patches missed. Critical or high-risk fixes older than 14 days. Laptops that are rarely switched on are the usual culprits.
• MFA not enabled. Cloud services with MFA available but off. Under the current rules this can end the assessment on the spot.
• Scope too narrow. Leaving out personal phones, remote laptops or a cloud service that holds company data.
• Shared and stale accounts. Generic logins, leavers still active and daily admin use.
• Guessing at the questionnaire. Answering yes without checking, then being unable to evidence it.
• Unreviewed firewall rules. Open inbound ports with no documented reason.

For a deeper look at the next level, read our Cyber Essentials and Cyber Essentials Plus comparison and our Cyber Essentials Plus audit guide.

How the Cyber Essentials questionnaire works

According to IASME, you buy the assessment for your organisation size and have up to six months to complete it. You answer the online Cyber Essentials questionnaire, a senior person confirms the answers, and a qualified assessor reviews them, typically within three working days. If more information is needed you resubmit. Once everything is met, the certificate is issued and you receive a digital badge.

Download the question set and the requirements document before buying, and answer a draft offline. Fees vary by organisation size, so check the current IASME price list rather than relying on a quoted figure. Cyber Essentials Plus adds a hands-on technical audit on top, arranged through a certification body.

Conclusion: meeting the Cyber Essentials requirements first time

The Cyber Essentials requirements come down to five controls, applied consistently to every device, account and cloud service in your scope. Get MFA, patching and scope right and you remove most reasons for failure.

Work through the checklist, gather evidence from your Microsoft 365 or Intune tenant, and treat the 14-day patch rule as a standing process rather than an annual scramble. If you would like a second pair of eyes before you submit, our cyber security audit services can test your readiness.

Frequently asked questions