In short. Cyber Essentials rests on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection, applied to every in-scope device and cloud service under the v3.3 (Danzell) requirements in force since 27 April 2026. Written by an IASME-licensed certification body, this guide explains what each control requires, what the assessor checks and where applicants most often fail.
Cyber Essentials is built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. They are set by the National Cyber Security Centre (NCSC), administered by IASME, and applied to every device and cloud service in scope, including staff phones and laptops used for work. The current requirements are version 3.3, known as the Danzell question set, which took effect on 27 April 2026. This guide explains what each control requires, what an assessor is actually checking, and where applicants most often fall short.
Incursion Cyber Security is an IASME-licensed certification body for Cyber Essentials and Cyber Essentials Plus, so what follows is written from the assessor’s side of the table.
Why five controls
The NCSC chose these five because, applied properly, they stop the large majority of untargeted, internet-borne attacks: the automated scanning, credential stuffing, commodity malware and opportunistic exploitation that make up most of what hits a UK business. The government’s Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses identified an attack in the previous year. Very few of those attacks needed anything a well-configured firewall, prompt patching, no shared admin accounts, multi-factor authentication and working malware protection would not have defeated.
The controls are not advanced. That is the point. Cyber Essentials is a floor, not a ceiling, and the value of certification is that an independent body has checked the floor is actually there.
1. Firewalls
What it requires. Every device in scope sits behind a correctly configured firewall, whether that is the boundary firewall or router at the office, the software firewall on a laptop used at home or in a coffee shop, or the network controls in front of your cloud services. Default administrative passwords on firewalls and routers must be changed, inbound rules must be justified and documented, and the administrative interface must not be reachable from the internet unless it is protected by multi-factor authentication or restricted to known addresses.
What the assessor checks. That you know what your boundary is, that every inbound rule has a business reason and an owner, that remote management is either off or properly protected, and that host-based firewalls are switched on for devices that leave the office. In a Cyber Essentials Plus audit we test this directly with an external vulnerability scan against every internet gateway.
Where applicants fall short. A remote-access or management service left reachable from the internet because it was convenient during a project and never closed. A router still on its factory password. A home worker whose laptop firewall was turned off to make a printer work.
2. Secure configuration
What it requires. Devices and software are set up to reduce their attack surface rather than left on defaults. That means removing or disabling accounts, software and services you do not use, changing default passwords, disabling auto-run for removable media, and locking devices with a PIN, password or biometric so that a lost laptop or phone does not become a breach. Passwords protecting accounts must meet the scheme’s length and quality rules, and there must be protection against brute-force guessing.
What the assessor checks. That there is a build or checklist for new devices, that unused software and guest accounts are gone, that device locking is enforced rather than hoped for, and that your password policy matches the requirements. At Plus, a sample of devices is examined for exactly this.
Where applicants fall short. Bloatware and trial software still present on laptops bought from retail. Phones used for work email with no screen lock. Shared local accounts with a password everyone knows.
3. Security update management
What it requires. All software in scope is licensed and supported by its vendor, has automatic updates enabled where possible, and receives security updates rated high or critical (or CVSS 7 and above) within 14 days of release. Software that is no longer supported must be removed or moved out of scope. Under the Danzell requirements, the 14-day timeline for operating systems, firmware and applications is now an automatic fail if not met.
What the assessor checks. That you have a list of what runs on your devices, that nothing on it is out of support, and that patching happens on a schedule you can evidence. At Plus we run an authenticated vulnerability scan on the sampled devices and look at the results: a missing critical patch older than 14 days fails the audit.
Where applicants fall short. This is the most common failure we see. Windows 10 reached end of support in October 2025 and is still running in a lot of organisations. Firmware on network devices that has never been updated. Browsers and productivity software set to update but with users who never restart. A legacy application that pins an old, unsupported operating system because the vendor has gone.
4. User access control
What it requires. User accounts are issued to named individuals, approved before creation, and removed when people leave or change role. Administrative accounts are separate from the accounts people use for email and browsing, and are only used for administration. Multi-factor authentication is required on all cloud services where it is available, for every user, and the Danzell requirements made this an automatic fail if missing.
What the assessor checks. A joiners-and-leavers process that actually runs. Evidence that administrators have two accounts and use the right one. MFA enabled across Microsoft 365, Google Workspace, your accounting platform, your CRM and every other cloud service that offers it, not just the ones you thought of first.
Where applicants fall short. The owner of a small business doing everything from a global admin account. MFA on the main email platform but not on the payroll system or the remote-access gateway. Accounts belonging to staff who left months ago and still work.
5. Malware protection
What it requires. Every device in scope has a mechanism to stop malware running: anti-malware software that is kept up to date and set to scan files on access and web pages on load, or an application allow-list that only permits approved software to run. Devices that only run apps from an approved store, such as most phones and tablets, can rely on that restriction, provided sideloading is not possible.
What the assessor checks. That protection is present, current and actually running on the sampled devices, and that it would block a test file. At Plus this is tested by downloading harmless test samples through the browser and by email.
Where applicants fall short. Macs with no anti-malware because someone believed they did not need it. Endpoint agents installed but silently stopped reporting. Users with the ability to install whatever they like, which defeats the point of an allow-list.
Scope: the control that is not a control
Everything above applies to what is in scope, and scope is where most Cyber Essentials assessments are actually won or lost. The scope must cover all devices that access organisational data or services, including personally owned phones and laptops used for work, and all cloud services. Under Danzell the scope description is more detailed and must state what is out of scope and why. An organisation can certify a subset of its estate, but the certificate then says so, and a customer reading it will notice.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is a verified self-assessment: you answer the question set, a senior person signs it, and an assessor at a certification body reviews and marks it. Cyber Essentials Plus is the same standard, audited. Within 90 days of passing the basic assessment, an assessor examines a sample of your devices, all internet gateways and externally facing servers, runs internal and external vulnerability scans and tests the malware controls. Under the Danzell requirements the device sample is drawn at random by the assessor, and if a retest is needed a fresh sample is taken. Both certificates are valid for twelve months.
Which you need depends on who is asking. Many contracts and frameworks specify Plus; Cabinet Office procurement guidance and NHS Supply Chain, for example, ask in-scope suppliers for Cyber Essentials Plus. Our Cyber Essentials and Cyber Essentials Plus pages explain the process and the prices for each.
Frequently asked questions
What are the five Cyber Essentials controls?
Firewalls, secure configuration, security update management, user access control and malware protection. They are defined in the NCSC’s Cyber Essentials Requirements for IT Infrastructure, currently version 3.3.
Is multi-factor authentication required for Cyber Essentials?
Yes. MFA must be enabled on all cloud services where it is available, for all users. Since the Danzell requirements took effect on 27 April 2026, missing MFA is an automatic fail.
How quickly do security updates have to be applied?
High and critical updates must be applied within 14 days of release. Unsupported software must be removed or taken out of scope.
Do personal phones count?
Yes, if they are used to access organisational data or services such as work email. They are in scope and must meet the controls, including device locking, supported operating system and a current version.
How long does Cyber Essentials take?
If the controls are already in place, the self-assessment can be completed in a few hours and marked within days. Most of the time goes into fixing gaps found while preparing. Plus adds an audit that is usually a day for a small organisation, scheduled within 90 days of the basic pass.
Who can certify us?
Any IASME-licensed certification body. Incursion Cyber Security is licensed for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance; our licences are listed with verification links on the accreditations page. Scoping for Cyber Essentials is done by organisation size and a short set of standard questions, reviewed by an assessor, and we offer a call if anything is unclear. Get in touch to start.