Cyber Essentials self-check: the five controls in plain English

Cyber Essentials is the UK government-backed minimum standard for cyber security, run by the National Cyber Security Centre (NCSC). It rests on five technical controls. This page turns each one into plain checks you can tick off for a small business. Each control locks when all of its checks are ticked.

Firewalls

Create a security filter between the internet and your network.

Every router, laptop and desktop that connects to the internet has its firewall switched on.
The default admin password on the router or firewall has been changed to one that is hard to guess.
No ports are opened to the internet unless there is a business reason, and you close them when the reason ends.
You know how to change the firewall settings, or who does it for you.

Secure configuration

Set up computers securely to minimise the ways in.

Software, apps and user accounts you don't use have been removed or switched off.
Default and guessable passwords have been changed on every device and service.
Devices lock with a PIN, password or fingerprint when left alone.
Auto-run for downloaded files and USB sticks is turned off.

Security update management

Stop criminals using known holes in software.

All software is licensed and still supported by its maker. Unsupported software has been removed.
Automatic updates are switched on wherever they can be.
Updates the maker calls critical or high risk are installed within 14 days of release.
Phones, routers and cloud services are included, not just computers.

User access control

Control who can reach your data and services, and what they can do.

Everyone has their own account. No shared logins.
Admin accounts are used only for admin tasks, not for email or web browsing.
Multi-factor authentication is on for cloud services wherever it is offered.
Accounts are removed or disabled promptly when someone leaves.

Malware protection

Find and stop viruses and other malicious software before they do harm.

Anti-malware is switched on and kept up to date on every computer, or apps can only come from approved stores.
Anti-malware scans files when they are opened and warns before risky websites.
Staff know what to do when a warning pops up.

What this is, and isn't

This is a self-check written for this site from the NCSC's description of the five controls. It is not the official question set and it is not a certificate. Certification is run by IASME, the NCSC's Cyber Essentials delivery partner, and the NCSC offers a free readiness tool.

NCSC: Cyber Essentials overview (the five controls and how to certify)
NCSC: Cyber Essentials resources (requirements and question set)
NCSC: Small business guide

Related guides on this site

Business groups, councils and IT providers are welcome to link to this checklist: https://cybersecurityalerts.net/cyber-essentials-self-check