AWS settings for Cyber Essentials
Five controls, in scheme order, with the setting path and question number for every step. Applies to AWS Management Console (paths checked against AWS documentation).
EC2 instances and their security groups are in scope for Cyber Essentials as IaaS. You must evidence security groups with no management ports open to the internet, MFA on the root user and every IAM identity, supported operating systems on each instance, critical updates within 14 days, anti-malware on Windows instances and application allow listing on Linux.
- Platform
- Amazon Web Services (IaaS) (Amazon)
- Applies to
- AWS Management Console (paths checked against AWS documentation)
- Paths last checked
- 2026-11
- Controls covered
- Firewalls, Secure configuration, Security update management, User access control, Malware protection
- Questions
- A2.7A4.6A4.8A5.1A5.2A5.3A5.4A6.1A6.4AUTO-FAILA6.4.2A6.5AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAILA7.3A7.8A7.9A8.1A8.2A8.3A8.4A8.5
- Steps
- 14 settings across 5 controls
- Reviewed against
- Requirements v3.3 and the Danzell question set v16.3
A4: how do you configure Amazon Web Services (IaaS) for firewalls?
Apply 3 settings in Amazon Web Services (IaaS): remove 0.0.0.0/0 on management ports, document each inbound rule and check with Security Hub. Together they provide evidence for A4.8, A5.4 and A4.6.
Security groups and network ACLs are the boundary firewall for EC2. Security groups deny inbound by default; every inbound rule is one you added. See the firewalls requirements for what the control asks.
A5: how do you configure Amazon Web Services (IaaS) for secure configuration?
Apply 2 settings in Amazon Web Services (IaaS): turn on the CIS AWS Foundations Benchmark and remove default and unused accounts on instances. Together they provide evidence for A5.2, A7.3, A5.1 and A5.3.
Default users, unused credentials and unnecessary services across the account and on instances. See the secure configuration requirements for what the control asks.
A6: how do you configure Amazon Web Services (IaaS) for security update management?
Apply 3 settings in Amazon Web Services (IaaS): create a patch policy, turn on Amazon Inspector for EC2 and retire unsupported AMIs. Together they provide evidence for A6.4, A6.4.2, A6.5, A6.1 and A2.7.
Patch Manager installs and reports updates; Amazon Inspector finds what is still missing. Together they evidence the 14-day rule. See the security update management requirements for what the control asks.
Create a patch policy
A6.4AUTO-FAILA6.4.2Systems Manager > Quick Setup > Patch Manager > Create > Patch operation: Scan and install > Installation schedule: weekly > Patch baseline: a baseline that approves Critical and Security (or Important) updates > Reboot if neededTurn on Amazon Inspector for EC2
A6.4AUTO-FAILA6.5AUTO-FAILAmazon Inspector > Activate Inspector (EC2 scanning is included); review Findings filtered by Severity: Critical and High
A7: how do you configure Amazon Web Services (IaaS) for user access control?
Apply 3 settings in Amazon Web Services (IaaS): enable MFA on the root user, require MFA for IAM users and Identity Center users and review privileged access. Together they provide evidence for A7.16, A7.17, A7.8, A7.9 and A7.3.
MFA on root and every human identity, least-privilege permission sets, and regular access reviews. See the user access control requirements for what the control asks.
Enable MFA on the root user
A7.16AUTO-FAILSign in as the root user > account name (top right) > Security credentials > Multi-factor authentication (MFA) > Assign MFA device: Passkey or security key, Authenticator app or Hardware TOTP tokenRequire MFA for IAM users and Identity Center users
A7.17AUTO-FAILA7.16AUTO-FAILIAM > Users > select user > Security credentials tab > Multi-factor authentication (MFA) > Assign MFA device; IAM Identity Center > Settings > Authentication tab > Multi-factor authentication > Configure > Prompt users for MFA: Every time they sign in (always-on)
A8: how do you configure Amazon Web Services (IaaS) for malware protection?
Apply 3 settings in Amazon Web Services (IaaS): install endpoint anti-malware on Windows instances, apply allow listing on Linux instances and add GuardDuty Malware Protection as a detection layer. Together they provide evidence for A8.1, A8.2, A8.3, A8.4 and A8.5.
Requirements v3.3 allow anti-malware software only for Windows and macOS. Windows instances need an endpoint product running in the instance; Linux instances use application allow listing. See the malware protection requirements for what the control asks.
Add GuardDuty Malware Protection as a detection layer
A8.1GuardDuty > Protection plans > Malware Protection for EC2: EnableGuardDuty scans the attached EBS volumes when it detects suspicious behaviour, or when you start an on-demand scan. It does not stop malware running, so it supports A8.1 but does not meet it alone.
Which questions does this guide cover?
The 21 questions below are the ones Amazon Web Services (IaaS) can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.
| Question | What it asks | Steps in this guide |
|---|---|---|
| A2.7 | Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. | A6: Retire unsupported AMIs |
| A4.6 | Have you reviewed your firewall rules in the last 12 months? | A4: Check with Security Hub |
| A4.8 | Please describe how you approve and document your allowed inbound connections. | A4: Remove 0.0.0.0/0 on management ports; A4: Document each inbound rule |
| A5.1 | Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? | A5: Remove default and unused accounts on instances |
| A5.2 | Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business? | A5: Turn on the CIS AWS Foundations Benchmark; A5: Remove default and unused accounts on instances |
| A5.3 | Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials? | A5: Remove default and unused accounts on instances |
| A5.4 | Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet? | A4: Remove 0.0.0.0/0 on management ports |
| A6.1 | Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? | A6: Retire unsupported AMIs |
| A6.4AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | A6: Create a patch policy; A6: Turn on Amazon Inspector for EC2 |
| A6.4.2 | Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release? | A6: Create a patch policy |
| A6.5AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release? | A6: Turn on Amazon Inspector for EC2 |
| A7.16AUTO-FAIL | Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? | A7: Enable MFA on the root user; A7: Require MFA for IAM users and Identity Center users |
| A7.17AUTO-FAIL | Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | A7: Require MFA for IAM users and Identity Center users |
| A7.3 | How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? | A5: Turn on the CIS AWS Foundations Benchmark; A7: Review privileged access |
| A7.8 | Do you formally track which users have administrator accounts in your organisation? | A7: Review privileged access |
| A7.9 | Do you review who should have administrative access on a regular basis? | A7: Review privileged access |
| A8.1 | Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either: | A8: Install endpoint anti-malware on Windows instances; A8: Apply allow listing on Linux instances; A8: Add GuardDuty Malware Protection as a detection layer |
| A8.2 | If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection? | A8: Install endpoint anti-malware on Windows instances |
| A8.3 | If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites? | A8: Install endpoint anti-malware on Windows instances |
| A8.4 | If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications? | A8: Apply allow listing on Linux instances |
| A8.5 | If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications? | A8: Apply allow listing on Linux instances |
What evidence should you keep for the assessor?
Keep the 4 dated records listed below for Amazon Web Services (IaaS). They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.
The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.
- Security group export with descriptions.
- Patch Manager compliance report and Inspector findings export.
- IAM credential report showing MFA on every user, and the Identity Center MFA setting.
- Security Hub CSPM summary for EC2.13, EC2.14 and the CIS benchmark.
Related guides and requirements
- Firewalls requirementsThe control hub behind the first section of this guide.
- A7.16 and A7.17: MFA on cloud servicesThe automatic-fail questions most setup gaps lead to.
- Check your readinessFree checker that asks the auto-fail questions first.
- Glossary: shared responsibility modelWhat you configure and what the provider patches.
- Cloud services in scopeIaaS, PaaS and SaaS responsibilities.
- CE Plus test case 2: authenticated patch scanIaaS instances are sampled too.
- Microsoft Azure (IaaS)Cloud platform
- Supported software listEnd-of-support dates for operating systems and applications.
- Cyber Essentials Plus: how to prepareWhat the tester checks on the day.
Frequently asked questions
Yes. The root user is the most privileged account in the account and must have MFA for A7.16. Do not use it for day-to-day work; create IAM Identity Center users with least-privilege permission sets and keep the root credentials for emergencies only.
Not on its own. Requirements v3.3 need anti-malware software that prevents malware running and blocks malicious websites, on Windows and macOS devices. GuardDuty Malware Protection scans volumes after a detection or on demand. Run an endpoint product inside Windows instances and use application allow listing on Linux.
No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.
The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- docs.aws.amazon.comAWS Docs: Security Hub controls for Amazon EC2Read on docs.aws.amazon.com (opens in a new tab)
- docs.aws.amazon.comAWS Docs: Systems Manager Patch ManagerRead on docs.aws.amazon.com (opens in a new tab)
- docs.aws.amazon.comAWS Docs: MFA in IAMRead on docs.aws.amazon.com (opens in a new tab)
- docs.aws.amazon.comAWS Docs: Patch policies in Quick SetupRead on docs.aws.amazon.com (opens in a new tab)
- docs.aws.amazon.comAWS Docs: Prompt users for MFA in IAM Identity CenterRead on docs.aws.amazon.com (opens in a new tab)