Cyber Essentials, the UK baseline made practical

Cover the whole IT infrastructure used to run the organisation, or a well-defined and separately managed sub-set, and define the scope boundary by business unit, network boundary and physical location and agree it with the certification body before assessment. Justify any partial scope to the assessor.

Apply the requirements to every in-scope device and software item that accepts incoming internet connections, makes outgoing internet connections, or controls the flow of data between those and the internet. A scope without end-user devices is not acceptable.

Include all accounts your organisation owns even when a supplier, contractor or managed service provider uses them, and be able to show that externally managed services meet the five controls. Devices you own and lend to a third party are in scope.

Include cloud services that host your data or services. You are always responsible for the controls, but where the provider implements a control, make sure it has committed to this in contract clauses or documents referenced by the contract.

Include user-owned devices that access organisational data or services. Devices used only for native calls, native texts or MFA apps are out of scope.

Include corporate and BYOD devices used for home or remote work, and any router you supply. Other routers are out of scope, so apply software firewalls on user devices.

Protect every in-scope device with a correctly configured firewall or a network device with firewall functions, and use a software firewall on devices used on untrusted networks such as public wifi.

Change default administrative passwords on firewalls to strong, unique ones, or disable remote administration completely.

Block access to the firewall administration interface from the internet unless there is a documented business need, and then protect it with multi-factor authentication or with an IP allow list plus well-managed passwords.

Block unauthenticated inbound connections by default.

Have an authorised person approve and document each inbound firewall rule, including the business need.

Remove or disable firewall rules when they are no longer needed.

Regularly remove and disable unnecessary user accounts, such as guest accounts and unused admin accounts.

Change any default or guessable account passwords.

Remove or disable unnecessary software, including applications, system utilities and network services.

Disable any auto-run feature that lets files execute without user authorisation.

Make sure users are authenticated before they can access organisational data or services.

Use appropriate device locking for users who are physically present.

Protect biometric, password or PIN unlock methods against brute-force attacks where configurable, by throttling attempts to no more than 10 guesses in 5 minutes or locking the device after no more than 10 failed attempts.

Use a PIN or password of at least 6 characters when the credential only unlocks a device. If it is also used for authentication to services, apply the full password requirements.

Keep all in-scope software licensed and supported, meaning the vendor provides regular vulnerability fixes and has stated an end-of-support date.

Remove software from devices when it becomes unsupported, or take it out of scope using a defined sub-set that prevents all traffic to and from the internet.

Enable automatic updates where possible.

Install updates within 14 days of release where they fix vulnerabilities the vendor calls critical or high risk, with a CVSS v3 base score of 7 or above, or where the vendor gives no severity information.

Have a process to create and approve user accounts, including accounts used by third parties.

Authenticate users with unique credentials before they get access to applications or devices.

Remove or disable accounts when they are no longer needed, for example when someone leaves or after a defined period of inactivity.

Use multi-factor authentication where available, and always for authentication to cloud services.

Use separate accounts for administrative activities only, with no email, web browsing or other everyday use.

Remove or disable special access privileges when they are no longer needed, for example when someone changes role.

Protect passwords against brute-force guessing with at least one of MFA, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts.

Use technical controls on password quality: MFA, or a minimum length of 12 characters with no maximum, or a minimum of 8 characters with no maximum plus automatic blocking of common passwords using a deny list.

Help users choose unique work passwords by educating them, encouraging three or more random words, providing secure storage such as a password manager, and not enforcing regular password expiry or complexity rules.

Where MFA is used, make the password element at least 8 characters with no maximum, and use MFA for admin accounts and any account reachable from the internet. Passwordless methods such as FIDO2 passkeys count as MFA.

Have a process to change passwords promptly when a password or account is known or suspected to be compromised.

Keep a malware protection mechanism active on every in-scope device, using at least one of anti-malware software or application allow-listing, kept up to date as the vendor instructs.

If you use anti-malware software, update it in line with vendor advice and configure it to prevent malware running, prevent execution of malicious code and prevent connections to malicious websites.

If you use application allow-listing, actively approve applications before deployment, restrict execution with code signing, keep a current list and stop users installing unsigned or invalidly signed applications.

Have your systems independently tested to verify the five controls work in practice, in addition to the verified self-assessment.