Platform setup guides · reviewed 3 November 2026
Configure your platforms for Cyber Essentials
One guide per platform, one section per control, in scheme order. Every step gives the exact setting path and the question number it provides evidence for, so you can answer the notes fields precisely.
To configure a platform for Cyber Essentials, apply the five controls in scheme order: firewalls, secure configuration, security update management, user access control and malware protection. Each setting should map to a Danzell question, so the notes field can name the exact setting path. MFA on cloud services and 14-day updates come first, because both are automatic fails.
How do you use a setup guide for Cyber Essentials?
Work through the guide for each platform in scope, apply each setting, then quote the setting in the matching question's notes field. Keep a dated export or screenshot of each one as evidence.
Which settings matter most?
MFA for every user and administrator of every cloud service, and critical or high-risk updates within 14 days, matter most: a No to any of A7.16, A7.17, A6.4 or A6.5 fails the assessment on its own.
What do assessors check against these settings?
For the self-assessment, the assessor reads your notes fields and checks they describe a mechanism, such as a named policy assigned to all devices, rather than a yes. For Cyber Essentials Plus, the assessor tests sampled devices directly: an authenticated patch scan, malware test files, an MFA sign-in from an incognito session and an admin task run as the daily user. A setting that is configured but not applied everywhere fails on the device it missed.
- Guides
- 16 platforms, every path checked against current vendor documentation
- Structure
- One section per control, in scheme order, with the setting path and question number for every step
- Reviewed against
- Requirements v3.3 and the Danzell question set v16.3
- Last reviewed
- 3 November 2026
Which platforms have a setup guide?
Each guide shows when its paths were last checked against the vendor's official documentation and links to those pages. Vendor menus change, so confirm the path in your own console before you quote it.
- Identity and productivityMicrosoft 365 and Entra IDReviewed 2026-11Cyber Essentials v3.3 requires MFA for every user and administrator of Microsoft 365, separate admin accounts that are not used for email, and Microsoft 365 Apps kept on a supported update channel.Open the guide
- Identity and productivityGoogle WorkspaceReviewed 2026-11Cyber Essentials v3.3 requires 2-Step Verification for every Google Workspace user and super admin, super admin accounts kept for administration only, and prompt suspension of leavers.Open the guide
- Device managementMicrosoft IntuneReviewed 2026-11Intune can evidence four of the five Cyber Essentials controls on managed devices: the Windows firewall, device locking and AutoPlay, update rings that install critical updates within 14 days, standard-user enforcement, and Defender Antivirus.Open the guide
- Operating systemWindows 11Reviewed 2026-11A Windows 11 laptop or desktop meets Cyber Essentials when the Windows firewall is on for every profile, AutoPlay is off, the device locks and needs a 6-character PIN or password, Windows Update is on and not paused, the daily account is a standard user, and Defender Antivirus with SmartScreen is active and updating..Open the guide
- Operating systemmacOSReviewed 2026-11A Mac meets Cyber Essentials when the built-in firewall is on, unused sharing services and the Guest account are off, the screen locks and requires a password, Software Update installs macOS and security responses automatically, the daily account is not an administrator, and anti-malware software is active or app installs are limited to an approved list.Open the guide
- MobileiOS and iPadOSReviewed 2026-11An iPhone or iPad meets Cyber Essentials when it runs an iOS or iPadOS version Apple still patches, has a passcode of at least 6 digits, installs updates automatically, and can only install approved apps from the App Store.Open the guide
- MobileAndroidReviewed 2026-11An Android phone meets Cyber Essentials when its manufacturer still issues security patches for that model, the screen lock needs a PIN or password of at least 6 characters, system and app updates install within 14 days, and only approved Google Play apps can be installed.Open the guide
- Endpoint securityMicrosoft Defender for BusinessReviewed 2026-11Defender for Business evidences malware protection option A for Cyber Essentials on Windows and macOS: real-time protection, automatic security intelligence updates, tamper protection and web protection on every onboarded device.Open the guide
- FirewallFortinet FortiGateReviewed 2026-11A FortiGate meets the Cyber Essentials firewall control when the default admin password is changed, administrative access from the internet is disabled or protected by MFA or trusted hosts, inbound policies are deny by default with each allowed service documented, and FortiOS is updated within 14 days of any critical or high-risk fix..Open the guide
- FirewallSophos Firewall (XGS)Reviewed 2026-11A Sophos Firewall meets the Cyber Essentials firewall control when the default admin password is changed, WAN administrative access is disabled or limited by MFA and local service ACL exceptions, inbound rules are deny by default and documented, and SFOS firmware and hotfixes are applied within 14 days of any critical or high-risk fix..Open the guide
- FirewallCisco Meraki MXReviewed 2026-11A Meraki MX meets the Cyber Essentials firewall control when every Dashboard account uses two-factor authentication, local status page access is disabled or uses a unique password, inbound port forwards and firewall rules are documented and reviewed, and MX firmware is upgraded within 14 days of any critical or high-risk fix..Open the guide
- FirewallDrayTek VigorReviewed 2026-11A DrayTek Vigor router meets the Cyber Essentials firewall control when the admin password is changed from the default, management from the internet is switched off or limited to trusted IP addresses, open ports and port redirections are documented, the model is still supported, and firmware is applied within 14 days of any critical or high-risk fix..Open the guide
- FirewallUbiquiti UniFi (Dream Machine, Cloud Gateway)Reviewed 2026-11A UniFi gateway meets the Cyber Essentials firewall control when the UI account that owns the console uses MFA, remote management through the Ubiquiti cloud is off or protected by that MFA, port forwards and firewall policies are documented, and UniFi OS, the Network application and device firmware update within 14 days of any critical or high-risk fix..Open the guide
- FirewallWatchGuard FireboxReviewed 2026-11A WatchGuard Firebox meets the Cyber Essentials firewall control when the default admin and status passphrases are changed, management from the External interface is removed or limited to trusted IP addresses with MFA, inbound policies are documented, and Fireware is updated within 14 days of any critical or high-risk fix..Open the guide
- Cloud platformMicrosoft Azure (IaaS)Reviewed 2026-11Azure virtual machines and their network boundary are in scope for Cyber Essentials as IaaS.Open the guide
- Cloud platformAmazon Web Services (IaaS)Reviewed 2026-11EC2 instances and their security groups are in scope for Cyber Essentials as IaaS.Open the guide
Where to go next
- Requirements overview (v3.3)What each of the five controls asks for.
- User access control requirementsMFA, admin accounts and passwords.
- Supported software listEnd-of-support dates for operating systems and applications.
- Check your readinessFree checker that asks the auto-fail questions first.
- Cyber Essentials Plus: how to prepareWhat the assessor tests on sampled devices.
- Glossary: multi-factor authenticationThe four factor types the requirements accept.
Frequently asked questions
Start with your identity platform, usually Microsoft 365 and Entra ID or Google Workspace. MFA on every cloud service for users and administrators (A7.16 and A7.17) is an automatic fail under the Danzell question set, and it is set in the identity platform. Device management and operating system settings come next.
No. Cyber Essentials applies to every in-scope device, cloud service and boundary firewall. Each guide covers what one platform can evidence. You still need to answer the scope questions in A2 and apply the five controls to every other device, firewall and cloud service in scope.
No. The question set is what the assessor marks. The guides give the setting path behind each answer, so the notes fields can name the exact control, the devices it applies to and where the evidence is kept. Specific notes are marked faster than general statements.
No. Requirements v3.3 offer anti-malware software as an option only for Windows and macOS devices. Phones, tablets and Linux servers meet A8.1 through application allow listing: only approved, code-signed applications can be installed, and users cannot install anything else.
Policies that exist but are not assigned to every device or user, MFA exclusions for office locations or groups of users, updates that users can pause past 14 days, daily accounts with local admin rights, and firewall admin pages left open to the internet. Each guide flags where these settings live on that platform.
Every setting path was checked against the vendor's current official documentation on the date shown, and each guide links to the vendor pages it relies on. Vendor menus change between releases, so confirm the path in your own console before you quote it in a notes field.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)