Cyber Essentials requirements are the five technical controls an organisation must meet across everything in its scope to achieve certification: firewalls, secure configuration, security update management, user access control and malware protection. The National Cyber Security Centre (NCSC) publishes them in Cyber Essentials: Requirements for IT Infrastructure v3.3, which applies from 27/04/2026.
What does Cyber Essentials actually require?
Cyber Essentials requires every device, account and cloud service in scope to meet five technical controls:
- Firewalls: protect every device in scope with a correctly configured firewall
- Secure configuration: remove default passwords, unused accounts and unnecessary software
- Security update management: run only licensed, supported software and apply high-risk and critical fixes within 14 days
- User access control: give accounts only to authorised people, keep admin accounts separate and use multi-factor authentication (MFA) on cloud services
- Malware protection: keep anti-malware software or application allow listing active on every device in scope
Cyber Essentials is a UK government-backed scheme, administered by IASME on behalf of the NCSC. It comes in two levels. For Cyber Essentials, the applicant completes a self-assessment questionnaire (SAQ) confirming the controls are in place across the entire scope. For Cyber Essentials Plus, the same controls are verified through a hands-on technical audit — see our Cyber Essentials Plus requirements guide for the testing detail. The Cyber Essentials hub explains the scheme at a high level; this page goes into what the controls demand of your environment.
The requirements are deliberately practical. Rather than asking you to write policies, the scheme checks whether your firewalls, devices, accounts, malware defences and software updates are configured to a defensible baseline. The requirements document puts the responsibility on the applicant: it is up to your organisation to make sure it meets every requirement, and you “might also be required to supply evidence before your Certification Body can award certification”. For the practical line-by-line readiness companion to these requirements, see our Cyber Essentials checklist.
Between them, the five controls cover servers, desktops, laptops, tablets, mobile phones, firewalls, routers and the cloud services (IaaS, PaaS and SaaS) that are in scope. The requirements document is updated periodically; v3.2 applied from 28/04/2025 to 26/04/2026 and v3.3 is the current version.
What are the requirements for firewalls and routers?
Every device in scope must be protected by a correctly configured firewall, or a network device with firewall functionality. Firewalls sit at the boundary between your trusted internal network and the internet; where your organisation does not control the network a device connects to, a software firewall on the device does the same job.
For every firewall, the requirements say you must:
- Change the default administrative password to a strong, unique password, or disable remote administrative access entirely
- Block access to the administrative interface from the internet, unless there is a clear and documented business need and the interface is protected by MFA or by an IP allow list combined with properly managed passwords
- Block unauthenticated inbound connections by default
- Make sure inbound firewall rules are approved and documented by an authorised person, with the business need recorded
- Remove or disable firewall rules that are no longer needed
You must also use a software firewall on devices used on untrusted networks, such as public Wi‑Fi hotspots. Most desktop and laptop operating systems come with a software firewall built in, and the NCSC advises turning it on in preference to a third-party firewall application.
Two common weaknesses here are home workers whose router still has the default admin password printed on the back, and cloud-first organisations who assume they have no firewalls in scope when every employee laptop needs its software firewall switched on.
Evidence worth gathering before you apply includes a record of the firewall admin password change, a list of inbound rules with their business justification, and confirmation that software firewalls are switched on across your devices.
What does secure configuration mean in practice?
Secure configuration means removing the weak points that come with devices and software out of the box before you put them into use. Typical weak points are default admin passwords, admin accounts without MFA, unnecessary user accounts and pre-installed applications or services you do not need.
To meet this control you must regularly:
- Remove or disable unnecessary user accounts, such as guest accounts and administrative accounts that will not be used
- Change any default or guessable account passwords
- Remove or disable unnecessary software, including applications, system utilities and network services
- Disable any auto-run feature that allows files to run without the user’s permission
- Make sure users are authenticated before they can access organisational data or services
- Set device locking for users who are physically present: a biometric, password or PIN before anyone can use the device, protected against guessing by throttling (no more than 10 guesses in 5 minutes) or by locking the device after no more than 10 failed attempts
If a password or PIN is only used to unlock a device, it must be at least 6 characters. If the same credential is also used to sign in to accounts, the full password rules apply. Those rules sit under user access control in the requirements document: use MFA, or a minimum password length of 12 characters, or a minimum of 8 characters with automatic blocking of common passwords, and in each case no maximum length.
MFA matters most for cloud services. The requirements say that authentication to cloud services must always use MFA, so if your organisation uses Microsoft 365, Google Workspace, AWS, Azure or any other cloud platform, every account that signs in to it needs MFA, not just the administrators.
Common weaknesses include legacy domain admin accounts without MFA, shared service accounts with static passwords stored in spreadsheets, and Wi‑Fi guest networks bridged onto the corporate network. Run through your Cyber Essentials self-assessment with secure configuration in mind early in your project — it is where many organisations find unexpected work.
How does user access control work under Cyber Essentials?
User access control makes sure accounts go only to authorised people and give them only the access their role needs. Admin accounts get extra care, because malware usually runs with the same privileges as the account that opened it.
The requirements say your organisation must:
- Have an approved process for setting up new user accounts
- Make every user sign in with their own credentials before they can reach applications or devices
- Remove or disable user accounts when they are no longer needed, for example when someone leaves or after a set period without use
- Use MFA wherever it is available, and always for authentication to cloud services
- Use separate accounts for administrative work only — no email, web browsing or other everyday tasks on an admin account
- Remove or disable special access privileges when they are no longer needed, for example when someone changes role
The rules also cover accounts used by third parties, such as a managed service provider supporting your systems. Passwordless sign-in is recognised too: the requirements describe passkeys (including FIDO2 authenticators, which count as MFA), biometrics, security keys, push notifications and one-time codes. SMS codes still count as MFA, but the NCSC recommends using an alternative where one will work for you.
Evidence worth gathering before you apply: your joiner, mover and leaver procedure, a list of administrative users with the reason each needs admin rights, MFA settings from your main cloud platforms and a sample of recently disabled leaver accounts.
The classic weakness is the long-serving employee whose role has changed three times and who still has admin rights from a previous job. The other big one is shared logins for finance, marketing or social media tools: the requirements call for unique credentials for each user, so shared accounts need a careful look.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
How do malware protection requirements work?
Every device in scope must have an active malware protection mechanism, using at least one of the two options in the requirements: anti-malware software or application allow listing. Many products have these built in, such as Microsoft Defender on Windows and XProtect on macOS, and you can also buy third-party products.
Whichever option you choose, it must be active, kept up to date in line with the vendor’s instructions and configured as follows:
- Anti-malware software (the option for Windows and macOS devices, including servers, desktops and laptops) must be updated in line with vendor recommendations, prevent malware from running, prevent malicious code from running and block connections to malicious websites
- Application allow listing (an option for all devices in scope) allows only approved applications, restricted by code signing, to run. You must approve applications before deploying them, keep a current list of approved applications, and stop users installing anything unsigned or with an invalid signature
Phones and tablets are in scope too. Anti-malware software is listed as the option for Windows and macOS devices, so for mobile devices application allow listing is the option the requirements describe.
A common weakness is the unmanaged personal device: an employee’s own Mac used for work email, with no enrolment, no centrally enforced anti-malware policy and no visibility for IT. Either bring the device under management or move that work onto a managed device.
What does security update management require?
Security update management requires all software in scope to be licensed, supported and kept up to date. “Supported” means a vendor has committed to providing regular vulnerability fixes and has published the date when that support will stop. Software past that date has to come off your devices.
The requirements say all software on in-scope devices must:
- Be licensed and supported
- Be removed when it becomes unsupported, or moved out of scope into a defined sub-set that blocks all traffic to and from the internet
- Have automatic updates turned on where possible
- Be updated within 14 days of release where the update fixes vulnerabilities the vendor rates “critical” or “high risk”, fixes vulnerabilities with a CVSS v3 base score of 7 or above, or comes with no details from the vendor about how serious the fixed vulnerabilities are (the 14-day rule)
If a single update fixes several issues and any of them is critical or high risk, the whole update must go on within 14 days. The NCSC also strongly recommends, though does not require, applying all released updates within 14 days.
A missed 14-day window is a common weakness, particularly on servers that are only patched in a monthly maintenance window.
Software in the requirements means operating systems, off-the-shelf applications, extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. In practice that covers productivity suites, browsers and browser extensions, PDF readers, video conferencing tools, password managers and line-of-business apps.
Summary table: the 5 controls at a glance
The table below summarises the five Cyber Essentials controls, what each one requires under v3.3 and the common weaknesses to check for.
| Control area | Key requirements | Common weaknesses |
|---|---|---|
| 1. Firewalls and routers | Firewall on every device in scope; change default admin passwords; block unauthenticated inbound traffic; document and approve inbound rules; software firewall on devices used on untrusted networks; protect internet-facing admin interfaces with MFA or an IP allow list. | Default passwords on routers used by home workers; software firewalls switched off on laptops; undocumented or stale inbound rules. |
| 2. Secure configuration | Remove unused accounts and software; change default passwords; disable auto-run; authenticate users before access; device locking with brute-force protection; 6-character minimum for unlock-only PINs and passwords. | Legacy admin accounts without MFA; default credentials on network devices; unused software and services on standard builds. |
| 3. User access control | Process to create and approve accounts; unique credentials; remove leavers and inactive accounts; separate admin accounts; MFA where available and always for cloud services; passwords of 12 characters, or 8 with a deny list, unless MFA is used. | Admin rights built up over time; admins browsing the web with privileged accounts; shared logins. |
| 4. Malware protection | Anti-malware software (Windows and macOS) or application allow listing on every device; kept up to date; blocks malware, malicious code and malicious websites. | Unmanaged personal devices; anti-malware out of date or switched off on servers; allow listing without a current approved app list. |
| 5. Security update management | Only licensed, supported software; remove unsupported software or isolate it; automatic updates where possible; critical and high-risk fixes within 14 days. | Missed 14-day window on servers; unsupported Windows versions or browsers still in use; out-of-date router firmware. |
Get started easily with a personal product demo
One of our onboarding specialists will walk you through our platform to help you get started with confidence.
What falls inside the Cyber Essentials scope?
How do cloud services fit into the requirements?
If your organisation’s data or services are hosted on cloud services, those services must be in scope; v3.3 states that cloud services cannot be excluded. Your organisation is always responsible for making sure every control is in place, although the cloud provider may implement some of them for you. The requirements describe three types of cloud service:
- Software as a Service (SaaS) — e.g. Microsoft 365, Dropbox and Gmail. The provider typically handles firewalls, security updates and malware protection. You and the provider share secure configuration, and user access control (including MFA) is yours.
- Platform as a Service (PaaS) — e.g. Azure Web Apps and AWS Lambda. The provider manages the underlying infrastructure and you manage the applications. You share secure configuration and security updates with the provider, the provider handles firewalls and malware protection, sometimes with your input, and user access control is yours.
- Infrastructure as a Service (IaaS) — e.g. Rackspace, Google Compute Engine and Amazon EC2. You configure and manage virtual servers and network equipment much like physical ones, sharing firewalls, secure configuration, security updates and malware protection with the provider. User access control is yours.
Where the provider implements a control on your behalf, you must make sure it has committed to do so in the contract or in documents the contract refers to, such as a security statement. Providers often explain this in their trust centre as a “shared responsibility model”.
How do BYOD and home working apply?
Devices your organisation owns, and personal devices used to access your organisation’s data or services, are in scope. That includes personal phones used for work email and a home PC used to reach cloud apps.
The exclusions are narrow: mobile or remote devices used only for native voice apps, native text apps or MFA apps are out of scope. Every other device must meet each relevant control, including supported software with current updates, malware protection and a device unlock credential.
Home and remote workers are in scope by default. If your organisation gives a home worker a router, that router is in scope too. All other home routers are out of scope, which means the firewall controls have to be applied on the device itself, usually through its software firewall. If the home worker connects through a corporate VPN, their internet boundary is the company firewall or a virtual or cloud firewall.
How do you decide what is in scope vs out of scope?
Scope is the first decision in a Cyber Essentials project: the requirements ask you to set the scope boundary before you work through the controls. Get it wrong and you either certify too narrow a slice of the business or take on more than you need.
The requirements allow two approaches:
- Whole-organisation scope — the whole of the IT infrastructure used to carry out your organisation’s business. The NCSC states that organisations choosing this scope “achieve the best protection and maximise their customers’ confidence”.
- Sub-set scope — a well-defined, separately managed part of the organisation whose network is segregated from the rest by a firewall or VLAN. You must justify the reason for a partial scope.
Either way, you must define the scope boundary clearly — the business unit managing it, the network boundary and the physical location — and agree it with your Certification Body before the assessment begins. A scope that leaves out end-user devices is not acceptable, and cloud services holding your data cannot be excluded.
Wherever you draw the line, the same five controls apply across everything inside it. Plan your scope before completing the SAQ; changing scope later costs time and money. Pricing scales with the size of the in-scope environment, so review our Cyber Essentials cost page when sizing your project.
What is new in the 2026 version?
Version 3.3 of Cyber Essentials: Requirements for IT Infrastructure applies from 27/04/2026 and keeps the five controls, the 14-day update rule and the password rules from v3.2. The NCSC lists these changes in v3.3:
- Cloud services defined — a new definition: an on-demand, scalable service on shared infrastructure, reached over the internet through an account, that stores or processes your organisation’s data.
- Cloud services cannot be excluded — a definitive statement that cloud services hosting your data or services must be in scope.
- Passwordless authentication updated — the definition now includes FIDO2 authenticators, which the requirements treat as passkeys and as MFA.
- Software development — the section now points to the Software Security Code of Practice. Publicly available commercial web applications are in scope by default; bespoke and custom components are not.
- Scope criteria — the criteria no longer refer to “untrusted connections”.
- Backing up data — the importance of backups is emphasised, although backing up is still not a technical requirement of Cyber Essentials.
Asset management is also covered but is not a separate control: the requirements describe it as something that helps you meet all five controls. When your certificate is due for renewal, the latest question set applies. See our Cyber Essentials renewal guide for what to expect when you re-certify under updated criteria.
Related Cyber Essentials guides
Continue your Cyber Essentials journey with the other guides in this series:
- Cyber Essentials Cost — IASME pricing tiers, Plus costs, hidden costs and 3-year totals for UK businesses.
- Is Cyber Essentials Worth It? — An honest assessment of the benefits, drawbacks and who actually needs certification.
- Cyber Essentials Plus Requirements — The technical audit, vulnerability scans and what Plus delivers over the basic certification.
- Cyber Essentials Self Assessment — The SAQ workflow, scope, evidence and common pitfalls.
- How Long Does Cyber Essentials Take? — Typical UK timeline, fast-track options and what slows the process.
- Cyber Essentials Renewal — The 12-month cycle, 2026 control changes and how to prepare 60 days out.
- Cyber Essentials for Small Business — SMB-specific pricing, scope and the cost-benefit case.
- Cyber Essentials vs ISO 27001 — Scope, cost, time and recognition compared.
Why choose ISMS.online for Cyber Essentials?
ISMS.online helps you prepare for Cyber Essentials and keeps your evidence ready for each renewal.
- Pre-mapped controls — Every Cyber Essentials control area is mapped in ISMS.online, so you assess against the full scheme without building your own checklist from scratch.
- Single source of evidence — Attach screenshots, configuration exports, joiner/leaver records and policy documents to the relevant control once, then reuse them across renewals, Plus assessments and other frameworks.
- Scope tooling — Capture your in-scope users, devices, networks and cloud services in a structured asset register so the scope boundary is documented, auditable and easy to update.
- Gap-to-action tracking — Every gap identified during your readiness review converts into an assigned action with an owner and due date, so nothing slips through.
- Multi-framework leverage — Cyber Essentials evidence held in ISMS.online can also support ISO 27001, SOC 2 and NIS 2 work. Our Cyber Essentials vs ISO 27001 guide explains how the two fit together.
- Renewal-ready — The platform keeps your evidence current between annual cycles, so you are never starting over when the next certificate is due.
- Room to grow — ISMS.online supports organisations from first-time Cyber Essentials applicants through to groups certified to ISO standards. Certificates are issued by Certification Bodies; ISMS.online helps you prepare.
Book a demo to see how ISMS.online supports your Cyber Essentials work.
FAQs
What does Cyber Essentials cover in plain English?
Cyber Essentials covers the basics that stop opportunistic attacks over the internet: keep unwanted traffic out, remove the weak default settings devices ship with, keep software patched, control who can log in and with what rights, and stop malware running. Backing up is not one of the technical requirements, although the NCSC highly recommends it.
Does Cyber Essentials apply to cloud services?
Yes, and accounts count as well as data. All accounts your organisation owns are in scope, even when a supplier, contractor or managed service provider uses them to look after your systems. If a third party manages your infrastructure, you must be able to confirm that the Cyber Essentials controls are met and show this in your assessment answers.
Are home workers and BYOD in scope?
Yes, and so are devices used by people outside your workforce in some cases. Devices your organisation owns and lends to a third party must be included. For devices you do not own, the requirements include a table showing, role by role (such as employees, volunteers, contractors and customers), which devices are in or out of scope.
What software is in scope for Cyber Essentials?
All software on in-scope devices, including firmware on routers and firewalls. Publicly available commercial web applications are in scope by default, but the bespoke and custom parts of web applications you build yourself are out of scope; the NCSC points to the Software Security Code of Practice for those.
Do you need to provide evidence for Cyber Essentials?
Possibly. The requirements document says that “you might also be required to supply evidence before your Certification Body can award certification at the level for which you’re applying.” Cyber Essentials Plus adds a hands-on technical audit of the same controls, so keeping records as you go saves time at either level.
