A router still running its factory password. A laptop three weeks behind on updates. A finance director doing everyday work from an administrator account. That is what most failed assessments look like, and none of it is sophisticated.
The five Cyber Essentials controls are firewalls, secure configuration, security update management, user access control and malware protection. Every UK certification is assessed against those five and nothing else. The standard in force is the NCSC’s Requirements for IT Infrastructure v3.3, published in April 2026 and delivered through IASME.
This guide works through what each of the Cyber Essentials controls actually asks for, using the wording of the standard rather than a summary of it. Where the 2026 update moved the line, it says so.
The five Cyber Essentials controls are firewalls, secure configuration, security update management, user access control and malware protection. Requirements for IT Infrastructure v3.3 has applied since April 2026. Missing multi-factor authentication on cloud services, or critical updates left beyond 14 days, now fails an assessment outright.
What Are the 5 Cyber Essentials Controls?
The five Cyber Essentials controls are firewalls, secure configuration, security update management, user access control and malware protection. They are set out in the NCSC’s Requirements for IT Infrastructure, and each one applies to a defined list of device types. Certification is pass or fail across all five.
Here is what each control is for, in the NCSC’s own framing:
- Firewalls make sure that “only secure and necessary network services can be accessed from the internet”.
- Secure configuration strips out the weak points that ship with default installations.
- Security update management keeps devices and software free of known flaws that already have fixes available.
- User access control limits accounts to authorised people, with only the access their role needs.
- Malware protection stops known malware and untrusted software from running.
Scope matters as much as the controls themselves. Version 3.3 added a definitive statement that cloud services cannot be excluded from scope, so software as a service sits inside the assessment whether or not you manage the infrastructure underneath it.
How Do You Pass Cyber Essentials First Time?
You pass first time by fixing the things that now cause an automatic fail before you open the questionnaire. Since April 2026, two areas are marked pass or fail on their own: multi-factor authentication on cloud services, and critical or high-risk updates left unapplied beyond 14 days. Get those right and most of what remains is evidence.
The 2026 update changed the paperwork as well. The question set is called Danzell, published by IASME on 13 February 2026, and it applies to assessment accounts created from 26 April 2026. If you are rehearsing against an older self-assessment, you are answering questions that no longer exist.
Three other things trip organisations up repeatedly. Unsupported software still sitting in scope. Administrator accounts used for email and browsing. And a scope drawn to keep the cloud out, which the standard no longer permits. Each of those cuts across several of the Cyber Essentials controls at once, which is why they are easy to miss.
Not Sure Your Controls Would Pass Today?
We hold Cyber Essentials Plus ourselves, and we help organisations close the gaps in the five controls before they submit rather than after a fail. A short conversation will tell you where you stand.
Get a Strategic ConsultationControl 1: What Do the Firewall Requirements Cover?
Firewalls are the first of the Cyber Essentials controls, and they require every in-scope device to sit behind a correctly configured firewall, whether that is a boundary firewall at the network edge or a software firewall on the device itself. The control covers boundary firewalls, desktop computers, laptops, routers, servers and cloud services. Any device used on an untrusted network needs the software firewall.
For every firewall, your organisation must:
- change default administrative passwords to something strong and unique, or disable remote administrative access entirely
- keep the administrative interface off the internet, unless there is a clear and documented business need protected by multi-factor authentication or a tightly scoped IP allow list
- block unauthenticated inbound connections by default
- have inbound rules approved and documented by an authorised person, with the business need written down
- remove or disable rules once they are no longer needed
That fourth point catches people out. An assessor can ask who approved a rule and why, and “it was already there” is not an answer. If your firewall rules have never been reviewed, start there, because it is usually the oldest debt in the estate.
Control 2: What Does Secure Configuration Require?
Secure configuration means removing the weak points that arrive as standard on new devices and services. Out of the box, systems often ship with a publicly known default password, pre-enabled accounts nobody needs, and software nobody asked for. This control applies to servers, desktops, laptops, tablets, mobile phones, thin clients and cloud services.
You must regularly:
- remove or disable unnecessary user accounts, including guest accounts and administrative accounts that will not be used
- change any default or guessable account passwords
- remove or disable unnecessary software, including applications, system utilities and network services
- disable any auto-run feature that lets files execute without the user authorising it
- authenticate users before they reach organisational data or services
- apply device locking controls for users who are physically present
Device unlocking carries its own rule. A biometric, password or PIN must be in place, with a minimum length of six characters where the credential only unlocks the device. Brute-force protection is required too: either throttle attempts, allowing no more than 10 guesses in five minutes, or lock the device after no more than 10 unsuccessful attempts. Where that same credential also authenticates the user to services, the full password rules from control four apply instead.
Control 3: How Quickly Must Security Updates Be Applied?
Critical and high-risk security updates must be installed within 14 days of release. Cyber Essentials defines critical or high risk as a CVSS v3 base score of 7 or above, or anything the vendor itself labels that way. The control reaches servers, desktops, laptops, tablets, mobile phones, firewalls, routers and cloud services.
Software in scope must:
- be licensed and supported
- be removed from devices once it becomes unsupported, or taken out of scope using a defined sub-set that prevents all traffic to and from the internet
- have automatic updates enabled wherever that is possible
- be updated, including vulnerability fixes, within 14 days of release where the fix addresses a critical or high-risk vulnerability
Two details matter more than they appear to. If the vendor provides no severity information at all, the 14-day clock still applies. And when a vendor bundles several fixes into a single update, one critical issue pulls the whole update inside the 14 days.
This is now an automatic fail. Questions A6.4 and A6.5 in the Danzell set mark timely updates as pass or fail on their own, which is a real change from previous years. Where patching is manual and occasional, vulnerability management is the gap to close before anything else.
Control 4: What Does User Access Control Require?
User access control requires that accounts belong to authorised individuals, are approved before they are created, and grant only the access a role genuinely needs. It applies to servers, desktops, laptops, tablets, mobile phones and cloud services, and it explicitly includes third-party accounts such as those used by your support provider.
Your organisation must:
- have a process to create and approve user accounts
- authenticate users with unique credentials before granting access
- remove or disable accounts when they are no longer required, including after a defined period of inactivity
- implement multi-factor authentication where available, and always for cloud services
- use separate accounts for administrative activities only, with no emailing, web browsing or other standard user work
- remove special access privileges when someone changes role
Password quality has to be managed with technical controls, and the standard gives three permitted routes:
| Approach | What the standard requires |
|---|---|
| Multi-factor authentication | MFA in place on the account. Mandatory for cloud services, whatever the password length |
| Password only, longer | Minimum of 12 characters, with no maximum length restriction |
| Password only, shorter | Minimum of 8 characters, no maximum, plus automatic blocking of common passwords using a deny list |
Passwordless authentication counts here. Version 3.3 updated the definition to include FIDO2 authenticators, which are regarded as multi-factor because the user is authenticated as part of the process. Passkeys sit in the same category.
Control 5: Which Malware Protection Options Are Allowed?
Malware protection, the last of the Cyber Essentials controls, must be active on every in-scope device, and the standard accepts two mechanisms. You can run anti-malware software, or you can allow-list applications using code signing. At least one has to be in place on each device, kept up to date in line with the vendor’s instructions, and configured as the standard sets out.
Anti-malware software, offered for in-scope devices running Windows or macOS, must be configured to:
- update in line with the vendor’s recommendations
- prevent malware from running
- prevent the execution of malicious code
- prevent connections to malicious websites over the internet
Application allow listing, available for any in-scope device, means only approved applications restricted by code signing may execute. You must actively approve applications before deploying them, keep a current list of what is approved, and stop users installing anything unsigned or carrying an invalid signature.
Built-in tooling is fine. Microsoft Defender, configured properly, satisfies the anti-malware option across most estates. What fails is software that is installed but not configured, or quietly not updating. The detection layer above this baseline is managed detection and response, which is a different job from certification.
Your Cyber Essentials Requirements Checklist
Use this Cyber Essentials checklist as a pre-submission pass. It is the short form of the cyber essentials requirements checklist UK organisations are actually assessed against, and it follows the order of the five Cyber Essentials controls.
- Scope it honestly. Include every device and every cloud service. Since v3.3, cloud services cannot be excluded.
- Firewalls. Default passwords changed, admin interfaces off the internet, inbound rules documented and approved, unused rules removed.
- Secure configuration. Unused accounts and software removed, auto-run disabled, device locking and brute-force protection in place.
- Security updates. Everything licensed and supported, automatic updates on, critical and high-risk fixes inside 14 days.
- User access control. MFA on every cloud service, separate administrator accounts, leavers removed, password quality met by one of the three permitted routes.
- Malware protection. Anti-malware or application allow listing active and correctly configured on every device.
- Check the question set. Accounts created from 26 April 2026 use Danzell and Requirements v3.3. The NCSC scheme overview links the current documents.
- Decide on Plus. If you need Cyber Essentials Plus, book the audit within three months of your self-assessment certificate.
Work through it honestly and most organisations find two or three gaps, not twenty. The ones that fail are usually the ones that assumed instead of checking.
Conclusion
The five controls Cyber Essentials sets out are not complicated, and that is rather the point of them. They describe a baseline any organisation ought to be able to hold: known devices, current software, controlled accounts, and something stopping malicious code from running. Most of the effort in certification goes into finding where reality has drifted away from that.
The 2026 changes narrow the room for interpretation. Cloud services are in scope. MFA on cloud services is not a judgement call. Critical updates inside 14 days is a hard line rather than a target. Organisations that used to scrape through on interpretation will feel the difference this year.
Transputec holds Cyber Essentials Plus, and we help organisations close the gaps in their Cyber Essentials controls before they submit rather than after they fail. If you want an honest read on where your five controls stand, talk to our team.
FAQs
Do the Cyber Essentials Controls Apply to Cloud Services?
Yes. Requirements for IT Infrastructure v3.3 added a definitive statement that cloud services cannot be excluded from scope, covering infrastructure, platform and software as a service. Who implements each control varies by model: user access control is always your organisation’s responsibility, while firewalls on software as a service sit with the provider. Our guide to Cyber Essentials cost covers what that scope means in practice.
What Counts as a Critical Security Update?
For Cyber Essentials, critical or high risk means a vulnerability with a CVSS v3 base score of 7 or above, or one the vendor describes as critical or high risk. If the vendor gives no severity detail at all, the update is still treated as urgent and the 14-day deadline applies. A bundled update containing one critical fix must be installed in full within 14 days.
Does Cyber Essentials Require Multi-Factor Authentication?
Yes. MFA must be implemented wherever it is available, and authentication to cloud services must always use it. Since the April 2026 update this is an automatic fail rather than a scored item, so a single cloud service without MFA can end the assessment. FIDO2 authenticators and passkeys are accepted as multi-factor.
What Is the Minimum Password Length for Cyber Essentials?
It depends which route you take. With multi-factor authentication in place, MFA satisfies the requirement. Without it, you need a minimum of 12 characters, or a minimum of 8 characters combined with automatic blocking of common passwords using a deny list. None of the three routes sets a maximum length, and passwords used only to unlock a device need at least six characters.
Are the Controls the Same for Cyber Essentials Plus?
They are identical. Cyber Essentials Plus assesses the same five controls, but adds independent technical testing to verify they work in practice rather than relying on self-assessment. You can complete the Plus audit within three months of your last Cyber Essentials certification, and certifying inside that window means you do not repeat the self-assessment questions. Our post on government contracts explains when buyers ask for Plus specifically.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
