Checklist · all five controls

Cyber Essentials checklist 2026

Every Cyber Essentials requirement under v3.3, control by control, with the evidence to gather and the Danzell question that asks for it. Shown as a table on the page, ready to print.

View as Markdown

Updated 22 September 2026

Short answer

The Cyber Essentials checklist covers five technical controls under Requirements v3.3 (April 2026): firewalls, secure configuration, security update management, user access control and malware protection. Each requirement maps to a Danzell question. Four questions fail automatically on a No: the 14-day patching rule (A6.4, A6.5) and MFA on cloud services (A7.16, A7.17). A7.15 fails if a listed service offers MFA.

Key facts

Rows: 39 requirements in 6 sections
Sections: Scope, Firewalls, Secure configuration, Security update management, User access control, Malware protection
Questions mapped: 76 Danzell questions
Scheme version: Requirements v3.3 (April 2026)

How do you use this checklist?

Work through the scope block first, then each control in order. Tick a row only when you hold the evidence named in the third column, because that is what the assessor will ask for in the notes fields.

The question column links to the Danzell question that covers the row. Questions marked auto-fail end the assessment on their own if answered no (A7.15 only if a service listed there does offer MFA), so clear those first. Tick the done column as you go, or print the page to work through it on paper.

What is on the Cyber Essentials checklist?

39 rows across 6 sections: each row gives the requirement, the evidence to gather and the Danzell question that asks about it, with a column to tick when it is done.

Done	Requirement	Evidence to gather	Question
1Scope7 rows
	The scope is the whole organisation, or a sub-set separated from the rest by a firewall or VLAN and described in full.	Evidence to gatherScope statement naming the business unit, network boundary and locations. Network diagram for a sub-set.	A2.1 A2.2 A2.2.1 A2.2.2
	Every end user device that reaches organisational data or services is in scope. A scope without end user devices is not accepted.	Evidence to gatherDevice inventory with quantity, make and operating system version for laptops, desktops, thin clients, tablets and phones, corporate and BYOD. Windows edition and feature version are required; the model is not.	A2.6 A2.6.1 A2.8
	Every cloud service holding organisational data or services is in scope. Cloud services cannot be excluded.	Evidence to gatherList of cloud services (IaaS, PaaS, SaaS) with the provider and the type of service. Include social media accounts, which the A2.9 guidance counts as cloud services.	A2.9
	User-owned devices (BYOD) that access organisational data are in scope unless used only for native voice, native text or MFA apps.	Evidence to gatherBYOD policy and the count of BYOD devices in the inventory.	A2.6 A2.8
	Home and remote workers are in scope. Organisation-supplied home routers are in scope; other home routers are out, so the device firewall applies.	Evidence to gatherCount of home and remote workers and how they connect (VPN, direct to cloud).	A2.4.1 A2.4.2
	Networks, network equipment and servers in scope are listed, including virtual servers, hypervisors and IaaS instances.	Evidence to gatherAsset register of networks, the make, model and quantity of firewalls and routers, and servers with OS versions. Switches and access points that do not contain a firewall or route internet traffic need not be listed.	A2.4 A2.5 A2.7
	A named person is responsible for managing the IT systems in scope. They must be a member of your organisation, not someone employed by an outsourced IT provider.	Evidence to gatherName and role of the internal IT owner, even where an MSP delivers the day-to-day work.	A2.10
2Firewalls7 rows
	Every device in scope is protected by a correctly configured firewall, either a boundary firewall or a software firewall on the device.	Evidence to gatherBoundary firewall inventory. Screenshot or MDM policy export showing the host firewall enabled on all computers and servers.	A4.1 A4.1.1 A4.1.2
	Default administrative passwords on firewalls and routers are changed to a strong, unique password, or remote administrative access is disabled entirely.	Evidence to gatherWritten password change process. Password manager entry or change record for each device.	A4.2 A4.2.1 A4.3 A4.4
	The firewall administrative interface is not reachable from the internet unless there is a documented business need and it is protected by MFA or an IP allow list with a managed password.	Evidence to gatherScreenshot of remote management settings. If enabled, the documented business need and the MFA or allow-list configuration.	A4.9 A4.10 A4.11
	Unauthenticated inbound connections are blocked by default.	Evidence to gatherFirewall rule export showing the default deny for inbound traffic.	A4.7
	Every inbound firewall rule is approved and documented by an authorised person, with the business need recorded. The A4.8 guidance says the business case is signed off at board level and its risks reviewed regularly.	Evidence to gatherFirewall rule log with rule, owner, board-level sign-off, approval date, business justification and last risk review.	A4.8
	Unnecessary firewall rules are removed or disabled when no longer needed, and the rule base is reviewed at least every 12 months.	Evidence to gatherDated rule review record saying when rules are reviewed, who decides to remove them and who checks it was done, plus the change tickets for removed rules.	A4.5 A4.6
	A software firewall is used on devices connected to untrusted networks such as public wifi.	Evidence to gatherHost firewall policy applied to laptops and mobile devices.	A4.1.1
3Secure configuration7 rows
	Unnecessary user accounts, including guest accounts and unused administrative accounts, are removed or disabled.	Evidence to gatherLocal and domain account audit showing guest and default accounts disabled.	A5.2
	Default or guessable passwords on all user and administrator accounts are changed.	Evidence to gatherBuild checklist and a record of default credential changes for devices and cloud services.	A5.3
	Unnecessary software, system utilities and network services are removed or disabled.	Evidence to gatherStandard build document or MDM configuration listing removed applications and disabled services.	A5.1
	Any auto-run feature that executes files without user authorisation is disabled.	Evidence to gatherGroup Policy, MDM or configuration profile export showing AutoPlay and auto-run disabled. A setting that prompts the user each time removable media is inserted is accepted by the A5.8 guidance.	A5.8
	Users are authenticated before they can access organisational data or services, including external services that are not public.	Evidence to gatherList of external services with the authentication method for each (MFA, throttling, lockout, deny list).	A5.4 A5.5 A5.6 A5.7
	Devices that need a user to be physically present lock and require a biometric, password or PIN before access.	Evidence to gatherMDM or Group Policy export for screen lock and unlock method.	A5.9 A5.10
	Device unlock credentials are protected against brute force: no more than 10 guesses in 5 minutes, or lockout after no more than 10 failed attempts. Unlock-only PINs or passwords are at least 6 characters.	Evidence to gatherLockout and throttling settings from the device policy. Minimum PIN length setting.	A5.9 A5.10
4Security update management4 rows
	All operating systems and software in scope are licensed and supported by a vendor that produces regular security fixes.	Evidence to gatherSoftware inventory with versions for browsers, anti-malware, email clients and office applications. Licence and subscription renewal dates, because some firmware and software stop receiving updates when an annual licence lapses (A6.3). ESU enrolment for any Windows 10 device (A6.1).	A6.1 A6.2 A6.2.1 A6.2.2 A6.2.3 A6.2.4 A6.3 A6.3.1
	Unsupported software is removed from devices, or the devices are moved into a defined sub-set that blocks all traffic to and from the internet.	Evidence to gatherRemoval record, or the sub-set network design and firewall rules that block internet access.	A6.6 A6.7
	Automatic updates are enabled wherever the software allows it.	Evidence to gatherUpdate policy export (Windows Update, Intune, Jamf, RMM) showing auto-update enabled.	A6.4.1 A6.5.1
	Critical and high-risk updates (vendor-rated critical or high, CVSS v3 base score 7 or above, or unrated) for operating systems, applications and firmware are installed within 14 days of release.	Evidence to gatherPatch compliance report from the last 30 days showing no update older than 14 days. Firmware version list for firewalls and routers.	A6.4AUTO-FAIL A6.4.2 A6.5AUTO-FAIL A6.5.2
5User access control10 rows
	A documented process exists to create and approve user accounts before they are issued. The A7.1 guidance says approval comes from a person with a leadership role in the business.	Evidence to gatherJoiner process document and a sample approval record signed off by a director, partner or department head.	A7.1
	Every user and administrative account uses unique credentials. No shared logins.	Evidence to gatherAccount listing from the directory and each cloud service showing one account per person.	A7.2
	Accounts are removed or disabled when no longer required, for example when someone leaves or after a defined period of inactivity.	Evidence to gatherLeavers log cross-checked against the account listing. Inactive account report.	A7.3
	Users hold only the access privileges their current role requires, and special privileges are removed when no longer needed.	Evidence to gatherAccess review record and the admin account register with the date of the last review.	A7.4 A7.8 A7.9
	Administrative access is granted through a formal process, and separate accounts are used for administrative work only. Admin accounts are not used for email or browsing.	Evidence to gatherAdmin account naming convention and the approval process. For A7.7, either a technical control that blocks email or browsing from admin accounts or the policy and staff training record: the guidance accepts either.	A7.5 A7.6 A7.7
	Passwords are protected against brute force by MFA, throttling to no more than 10 guesses in 5 minutes, or lockout after no more than 10 failed attempts.	Evidence to gatherLockout or smart lockout policy export from the directory and each cloud service.	A7.10
	Password quality is managed by a technical control: MFA, a minimum of 12 characters, or a minimum of 8 characters with a deny list of common passwords. No maximum length.	Evidence to gatherPassword policy export. Deny list configuration where the 8-character option is used.	A7.11
	Staff are supported to choose unique, strong passwords: guidance on three random words, a password manager, no forced expiry and no complexity rules.	Evidence to gatherPassword guidance issued to staff and the password manager deployment record.	A7.12
	A process exists to change passwords promptly when a password or account is known or suspected to be compromised.	Evidence to gatherIncident or compromise procedure naming who resets what and how quickly.	A7.13
	MFA is enabled for every administrator and every user of every cloud service that offers it. Where MFA is used, the password element is at least 8 characters.	Evidence to gatherMFA enforcement report (conditional access, security defaults or per-service policy) for every cloud service. List of services that cannot offer MFA.	A7.14 A7.15AUTO-FAIL A7.16AUTO-FAIL A7.17AUTO-FAIL
6Malware protection4 rows
	A malware protection mechanism is active on every device in scope: anti-malware software or application allow listing.	Evidence to gatherAnti-malware console report or MDM compliance report listing every device.	A8.1
	Anti-malware software is kept up to date in line with vendor recommendations and prevents malware and malicious code from running.	Evidence to gatherConsole report showing signature or engine versions and real-time protection enabled.	A8.2
	Anti-malware software prevents connections to malicious websites over the internet.	Evidence to gatherWeb protection or safe browsing setting from the anti-malware console or browser policy.	A8.3
	Where application allow listing is used, only applications approved by the organisation and restricted by code signing can run. Users cannot install unsigned or invalidly signed applications.	Evidence to gatherAllow-listing policy export and the current approved application list with approval dates.	A8.4 A8.5

What evidence does the assessor expect?

For the self-assessment, the assessor reads the notes field under each question and decides whether the wording describes a control that meets the requirement. Vague answers get a query, and unanswered queries become a fail. The evidence column above tells you what to have to hand so that every notes field can be specific: the policy name, the setting, the number of devices it applies to and the date it was checked.

For Cyber Essentials Plus, the assessor does not rely on the notes. They scan the sampled devices, send test files, watch a user log in to each cloud service and try to run an administrative task as a standard user. The same evidence still matters, because it is how you confirm the controls are in place before the audit rather than during it.

How assessors check this

Assessors mark the notes fields, not the tick boxes. A row is only complete when the wording in your answer names the control, the setting and the scope it applies to. "We use Intune" is not an answer; "Intune compliance policy requires BitLocker, a 6-digit PIN and lockout after 10 attempts on all 42 Windows laptops" is.

Common failure

The software inventory for A6.2.1 to A6.2.4 lists product names without versions, and one of the browsers or office suites turns out to be out of support. That makes A6.3 a Yes, which means the licensed-and-supported requirement is not met. Export the version list from your RMM or MDM the same day you submit.

Frequently asked questions

There is no official checklist. This one is built from the NCSC Requirements for IT Infrastructure v3.3 (April 2026) and mapped to the IASME Danzell question set, so every row corresponds to a requirement the assessor marks. The official documents are linked in the sources block.

Four questions fail the whole assessment automatically on a No answer: A6.4 and A6.5 (critical or high-risk updates for operating systems and applications installed within 14 days) and A7.16 and A7.17 (MFA applied to all cloud administrators and users). A7.15 fails automatically if a cloud service listed there does offer MFA. A6.3 and A6.6 (unsupported software) are not auto-fails, but a non-compliant answer means the licensed-and-supported requirement is not met. Clear all of those rows first.

For the self-assessment you describe your controls in the notes fields and declare the answers are true; the assessor can ask for evidence and often does when an answer is vague. For Cyber Essentials Plus the assessor tests the evidence directly on sampled devices and cloud accounts.

An organisation with a standard device build, managed updates and MFA already enforced can gather the evidence in a day or two. Organisations that still need to remove unsupported operating systems or roll out MFA should expect the fixes to take longer than the paperwork.

The requirements document and the question set are updated by the NCSC and IASME, most recently to v3.3 and the Danzell question set in April 2026. Re-check the version banner on this page before each renewal; rows that changed are listed on the 2026 change log.

This checklist covers what you declare in the self-assessment question set. The Cyber Essentials Plus checklist covers what the assessor then tests under Test Specification v3.2: an external vulnerability scan, an authenticated patch scan, malware tests, MFA checks on every cloud service and an account separation check on sampled devices. Complete this one first, because Plus tests the same scope.

Fix them before you submit, starting with the auto-fail rows: critical and high-risk updates within 14 days (A6.4, A6.5) and MFA on every cloud service for administrators and users (A7.16, A7.17). Then remove or isolate unsupported software (A6.3, A6.6). Notes-field rows usually need a written process rather than a technical change, so they are often the quickest to close.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readiness Book a gap analysis, from £500

IASME Certification Body
CREST accredited
IASME fee included
UK offices in Leeds, Newcastle, London and Edinburgh

Sources

How do you use this checklist?

What is on the Cyber Essentials checklist?

1Scope7 rows

2Firewalls7 rows

3Secure configuration7 rows

4Security update management4 rows

5User access control10 rows

6Malware protection4 rows

What evidence does the assessor expect?

Related pages

Frequently asked questions

Is this the official Cyber Essentials checklist?

Which rows are auto-fails?

Do I need to send the evidence to the assessor?

How long does the checklist take to complete?

Does the checklist change every year?

How is this different from the Cyber Essentials Plus checklist?

What should I do with rows I cannot tick yet?

Would you pass the 2026 question set?