Cyber Essentials Requirements 2026: Plain-English Checklist

This guide follows the NCSC's current Requirements for IT Infrastructure v3.3, in force since 27 April 2026. IASME gave older applications six months to finish on version 3.2, so that option ends by late October 2026. We checked every rule on 22 October 2026.

How Cyber Essentials works

Cyber Essentials is a verified self-assessment, run for the NCSC by IASME. You answer the Danzell question set online, and a senior board member signs to confirm the answers. An external assessor marks them, and IASME gives you six months from applying to pass.

The NCSC's help and resources page has a free copy of the questions and a Readiness Tool. Use them to find gaps first. For fees, see what Cyber Essentials costs.

Scope: what has to be included

Scope is the boundary of what gets assessed. The NCSC says it should be your whole IT infrastructure, or a well-defined and separately managed sub-set. A sub-set must be split from the rest by a firewall or VLAN, and you must justify it to the assessor.

Certifying the whole organisation has a bonus. The NCSC says UK organisations with turnover under £20m that do so are entitled to free cyber liability insurance, arranged by IASME.

Two things can never be left out:

• End-user devices. A scope without laptops, desktops, tablets or phones is not acceptable.
• Cloud services. If your data or services sit in the cloud, those services are in scope. The NCSC names Microsoft 365 as an example.

The scope rules people ask about most:

• Home workers. Company and personal devices used for work at home are in scope. A router you give a home worker is in scope too. Their own broadband router is not, so the laptop's software firewall must do that job.
• Personal phones and tablets (BYOD). A personal device that opens work email, files or other company services is in scope. One used only for calls, texts and an authenticator app is out of scope.
• Outside help. Every account you own is in scope, including accounts your IT supplier uses. Devices owned by your IT supplier or contractors are out of scope.

The five technical controls

1. Firewalls

A firewall decides what can reach your devices from the internet. Fewer open doors means fewer ways in.

• Protect every device in scope with a correctly configured firewall. The NCSC advises turning on the one built into Windows or macOS.
• Change the router's default admin password to a strong, unique one, or turn remote admin off.
• Keep the admin page off the internet unless there is a documented need. If there is, protect it with MFA, or an IP allow list plus a well-managed password.
• Block unauthenticated inbound connections by default. Document and approve every inbound rule, and remove rules you no longer need.

2. Secure configuration

Out-of-the-box settings often include default passwords, spare accounts and software nobody uses. Attackers know those defaults too.

• Remove or disable accounts you do not need, such as guest accounts.
• Change any default or guessable passwords.
• Remove unneeded software and turn off auto-run.
• Make people sign in before they reach company data or services.
• Lock devices with a PIN, password or biometric, protected against guessing. If a device will not let you set a guessing limit, use the vendor's default.

3. Security update management

Attackers move quickly once a flaw is public. The NCSC says leaving critical fixes longer than 14 days "would constitute a serious security risk".

• Use only licensed software that the vendor still supports with security fixes.
• Remove unsupported software, or move it to a sub-set cut off from the internet.
• Turn on automatic updates wherever you can.
• Install critical and high-risk fixes within 14 days. This covers operating systems, apps, and router and firewall firmware.

If one update fixes several flaws and any is critical or high risk, the 14 days apply.

4. User access control

Every account is a way in, and admin accounts are the most valuable. Malware usually runs with the rights of the person who opened it.

• Have a process to create and approve accounts.
• Give every person their own unique sign-in.
• Remove or disable accounts when people leave or stop using them.
• Use MFA wherever it is available. Sign-in to cloud services must always use MFA.
• Give admins a separate account for admin work only, never for email or browsing.
• Remove admin rights when someone no longer needs them.

Text message codes count as MFA, though the NCSC recommends stronger methods where they work. Microsoft is also retiring its own SMS and voice codes for most users on 1 February 2027.

5. Malware protection

Malware arrives through email attachments, downloads and unapproved installs. Once it runs, the NCSC warns of failing systems, lost data and infection that spreads unseen.

Every device in scope needs one of two options:

• Anti-malware software, for Windows and macOS. It must update as the vendor recommends, stop malware running and block connections to malicious websites.
• Application allow listing, for any device. Only approved, code-signed apps can run, and users cannot install unsigned ones.

The anti-malware option covers only Windows and macOS, so iPhones, iPads and Android devices use allow listing. The NCSC's own example allows only vetted apps from the device's app store.

Backups are not a requirement, though the NCSC highly recommends them.

The exact numbers in the Cyber Essentials requirements

Mapping the controls to Microsoft 365 Business Premium

Microsoft says Business Premium includes Entra ID P1 and full Intune, plus Defender for Business. They help meet each control, but none of them passes the assessment for you.

Four details catch people out:

• Update timing. Windows Autopatch is available with Business Premium. Microsoft says a PC's compliance date is the release date plus your deferral plus the deadline. Deferrals can be set as long as 30 days, so keep deferral plus deadline under 14 days.
• Local admin rights. The person who joins a PC to Entra ID becomes a local administrator on it by default. If staff set up their own laptops, check they are not admins.
• Password settings. Smart lockout locks an account after 10 failed sign-ins by default. The global banned password list applies to every user automatically. Tenants created before 2021 may still force a 90-day expiry, so check yours.
• Other apps. Intune's Enterprise App Management, which updates non-Microsoft apps, needs a subscription on top of Intune.

Our Microsoft 365 security checklist shows where to find the MFA, admin and device settings.

A practical Cyber Essentials checklist

Why Cyber Essentials applications fail

The scheme itself names these failure points:

• No MFA on a cloud service that offers it. IASME says this is an automatic fail, whether MFA is free, included or a paid option. Check every cloud service, not only Microsoft 365.
• Late security updates. IASME made two Danzell questions automatic fails. They ask whether critical and high-risk fixes went on within 14 days, for operating systems, firmware and apps.
• Unsupported software on the day. IASME says the "point in time" is the date the certificate is issued, and systems must be supported then. Its knowledge hub says Windows 10 PCs are not compliant unless enrolled in Extended Security Updates.
• A scope that leaves things out. The NCSC does not allow you to exclude end-user devices or cloud services.
• At Plus, patching only the sampled devices. IASME found a small number of firms did this. A failed sample now means a retest that adds a new random sample, and a second failure revokes the Cyber Essentials certificate.

Two recent end dates matter. Windows 11 24H2 Home and Pro stopped getting updates on 13 October 2026. Office 2021 support ended the same month.

How Cyber Essentials Plus differs

Cyber Essentials Plus uses the same five controls and starts with the same self-assessment. A certification body then audits your systems, within three months of your most recent Cyber Essentials certification.

IASME says the audit includes an external vulnerability scan and tests on a sample of devices. It checks the 14-day rule, malware protection, admin rights and MFA on every cloud service. Plus cannot pass until every issue found is fixed. Our guide on who needs Cyber Essentials Plus helps you decide.

Worked example: a six-person firm

This example is illustrative. Take a six-person accountancy practice with six company laptops on Windows 11 Pro. It uses Microsoft 365 Business Premium, a cloud accounting system and its broadband provider's router. Four staff read work email on their own phones, and one partner works from home.

Scope. The practice certifies the whole organisation, which keeps the free insurance open to it. In scope are the six laptops, the four personal phones, the office router, Microsoft 365 and the accounting system. The partner's home router is out of scope, so that laptop's firewall must stay on.

Firewalls. The office manager changes the router's admin password, turns off remote admin and checks for undocumented port forwards. An Intune policy keeps Windows Firewall on everywhere.

Secure configuration. Two accounts left by former staff are deleted, and unused trial software comes off the laptops. Intune compliance rules require a passcode of at least 6 digits before a phone can open email.

Updates. Two laptops still on Windows 11 24H2 move to a supported version. Windows Autopatch handles Windows updates, with deferral plus deadline under 14 days, and Microsoft 365 Apps stay on a monthly channel. Desktop apps such as the PDF reader update automatically, and the router's firmware is checked.

Access. Conditional Access requires MFA for everyone, and MFA goes on in the accounting system too. The partner who runs IT gets a separate admin account, and staff lose local admin rights.

Malware. Defender for Business manages Microsoft Defender Antivirus and network protection on every laptop. Phones install apps from the official app stores only.

A second case: one old PC

Take a small workshop with one Windows 10 PC that runs older machine software and has no Extended Security Updates. IASME would treat it as non-compliant. The firm can enrol it, replace it, or move it to a sub-set with no internet traffic. IASME treats a sub-set as certifying only part of the organisation, so the free insurance would not apply. IASME says equipment that never connects to an internet-connected network need not be declared.

How cloud365.io can help

We help you prepare: we review your answers, support your submission and handle the renewal each year. Many fixes, such as MFA and updates, are already part of our Managed and Secure support plans. The certification body makes the final decision. Our Cyber Essentials packages set out what each one includes.