Remote monitoring and management (RMM)
Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance. Cyber Essentials does not name it, but it is often how the 14-day patching rule (A6.4, A6.5) is met. If a provider runs it for you, you must still be able to confirm the controls are met.
- Term
- Remote monitoring and management
- Also known as
- RMM, RMM tool
- Category
- Devices and software
- Requirement area
- D(v) Accounts used by third parties and managed infrastructure; 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term remote monitoring and management mean in Cyber Essentials?
Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
How does remote monitoring and management apply to Cyber Essentials?
In plain terms
Think of the company that monitors your burglar alarm. Sensors in your office report to their control room, and they can spot a problem before you do. RMM does the same for computers: a small program on each device reports back to your IT provider, who can push updates overnight or fix a fault without visiting. NinjaOne, Datto RMM and ConnectWise Automate are examples.
What Cyber Essentials asks
The scope section covers this under managed infrastructure: "If you’re using externally managed services (such as remote administration), you must be able to confirm that the Cyber Essentials technical controls are being met and be able to demonstrate this in your assessment answers." It also says all accounts your organisation owns are in scope, even when a supplier or managed service provider uses them.
Where automatic updates are not used, A6.4.2 and A6.5.2 ask how critical and high-risk updates still go on within 14 days. An RMM patch policy is often the answer, so describe it there. A2.10 asks who is responsible for your IT systems, and that person "must be a member of your organisation and cannot be a person employed by your outsourced IT provider."
What an assessor looks for
- A patch report from the provider that covers every device you listed, not only the ones the RMM agent happens to reach.
- The RMM agent treated as software in its own right: supported and kept up to date.
- Remote access protected. Ask how your provider secures sign-in to the RMM console, including MFA.
See third-party accounts and MSPs and the MSPs and IT providers page. Related: managed service provider, patch management, security update.
Related terms
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
Frequently asked questions
Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
In the 2026 Danzell question set, remote monitoring and management comes up at A2.10, A6.4.2, A6.5.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Remote monitoring and management relates to D(v) Accounts used by third parties and managed infrastructure; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.