Cyber Essentials (2026)

Every device in scope is protected by a correctly configured firewall (or a network device with firewall functionality). Default administrative passwords are replaced with strong, unique ones, or remote administration is switched off. The administrative interface cannot be reached from the internet unless there is a documented business need and it is protected by multi-factor authentication or by an IP allow list of trusted addresses combined with sound password handling. Unauthenticated inbound connections are blocked by default, each inbound rule is approved by an authorised person and documented together with its business need, and rules that are no longer needed are removed or disabled. Devices used on untrusted networks, such as public wifi, run a software firewall.

Computers and network devices are proactively managed so they expose only the functionality their role needs: unnecessary user accounts and software are removed or disabled, default and guessable passwords are changed, auto-run features that execute files without user approval are disabled, and users must authenticate before reaching organisational data or services. Devices that people use in person lock and need a credential (biometric, password or PIN of at least 6 characters) to resume, and that credential is protected against brute-force guessing by throttling attempts or locking after no more than 10 failures, where the device allows it.

All software on in-scope devices is licensed and supported, and is removed once it becomes unsupported (or taken out of scope in a defined sub-set that blocks all traffic to and from the internet). Automatic updates are enabled wherever possible. Updates that fix vulnerabilities the vendor rates critical or high, that score 7 or above on CVSS v3, or whose severity the vendor does not state are applied within 14 days of release.

The organisation controls the accounts and privileges that give access to its data and services, third-party accounts included. A defined process creates and approves accounts, every user authenticates with unique credentials, and accounts are removed or disabled when no longer needed, for example when someone leaves or after a defined period of inactivity. Multi-factor authentication is implemented wherever it is available, and authentication to cloud services always uses it; FIDO2 authenticators (passkeys) count as multi-factor authentication. Administrators use separate accounts for administrative work only, and special privileges are removed when no longer required. Password-based sign-in is protected against brute-force guessing (multi-factor authentication, throttling to no more than 10 guesses in 5 minutes, or lockout after no more than 10 failures), and password quality is managed by multi-factor authentication, a length of at least 12 characters, or at least 8 characters with a deny list of common passwords.

An active malware protection mechanism runs on every device in scope, kept up to date as the vendor instructs, using at least one of two options. The first is anti-malware software (for Windows or macOS devices) configured to stop malware and malicious code from running and to block connections to malicious websites. The second is application allow-listing: only applications approved in advance and restricted by code signing may run, the list of approved applications is kept current, and users cannot install anything unsigned or with an invalid signature.

An independent, NCSC-approved certification body performs an external vulnerability test against the organisation's internet-facing systems, verifying from outside the network that the self-assessed controls (particularly Firewalls and Security update management) actually hold up under technical scrutiny. Adopt together with CEP-2 — see this Framework's description.

The certification body performs an authenticated, on-network test against a representative sample of the organisation's workstations and servers, verifying controls (particularly Secure configuration, User access control, and Malware protection) from the perspective of a logged-in user or device already inside the network. If the update-management test fails, the retest covers the original sample plus a new random sample of devices, so patch the whole scope, not only the devices first tested. Adopt together with CEP-1 — see this Framework's description.