Secure configuration
Secure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in. It is the second of the five Cyber Essentials technical controls, covered by A5.1 to A5.10: unused accounts and software, default passwords, auto-run and device locking.
- Term
- Secure configuration
- Also known as
- Hardening, Device hardening
- Category
- Devices and software
- Requirement area
- 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term secure configuration mean in Cyber Essentials?
Secure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
How does secure configuration apply to Cyber Essentials?
In plain terms
When you move into a new office, you change the locks, collect the spare keys and clear out whatever the last tenant left behind. New devices arrive in the same state: a default password, a guest account nobody needs and trial software you never asked for. Secure configuration is the tidy-up you do before the device goes into use, and the checks you repeat afterwards.
What Cyber Essentials asks
The NCSC puts it plainly: "The default configurations of computers and network devices aren’t always secure." The requirement says you must regularly remove and disable unnecessary user accounts (A5.2), change default or guessable passwords (A5.3), remove or disable unnecessary software (A5.1), disable auto-run features (A5.8), authenticate users before they reach organisational data or services (A5.4 to A5.7), and set device locking for users who are physically present (A5.9 and A5.10).
The control applies to servers, desktop computers, laptops, tablets, mobile phones, thin clients, IaaS, PaaS and SaaS. The A5.1 guidance adds that you "need to check your cloud services and disable any services that are not required for day-to-day use."
What an assessor looks for
- A description in A5.1 of how you build devices, such as a standard image or an MDM profile, and how you check them afterwards.
- Evidence that the work is regular. The requirement says "regularly", not once at purchase.
- Cloud services included, not only laptops.
See the secure configuration requirements, the secure configuration questions and the Windows 11 setup guide. Related: device unlocking, auto-run, default password.
Related terms
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
Frequently asked questions
Secure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
In the 2026 Danzell question set, secure configuration comes up at A5.1, A5.2, A5.3, A5.8, A5.9, A5.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Secure configuration relates to 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.