# Cyber Essentials setup guides > Platform-by-platform settings that meet the five Cyber Essentials controls, each step naming the setting path and the Danzell question it satisfies. 16 guides. Site index: https://cyberessentialspreparation.com/llms.txt. Supported-software status: https://cyberessentialspreparation.com/supported/llms.txt. ## Identity and productivity - [Microsoft 365 and Entra ID](https://cyberessentialspreparation.com/setup/microsoft-365-and-entra-id.md): Cyber Essentials v3.3 requires MFA for every user and administrator of Microsoft 365, separate admin accounts that are not used for email, and Microsoft 365 Apps kept on a supported update channel.… Checked against Microsoft 365 Business Premium with Entra ID P1 (paths checked against Microsoft Learn), 2026-11. - [Google Workspace](https://cyberessentialspreparation.com/setup/google-workspace.md): Cyber Essentials v3.3 requires 2-Step Verification for every Google Workspace user and super admin, super admin accounts kept for administration only, and prompt suspension of leavers. In the Admin… Checked against Google Workspace Business Standard (paths checked against Google Workspace Admin Help), 2026-11. ## Device management - [Microsoft Intune](https://cyberessentialspreparation.com/setup/microsoft-intune.md): Intune can evidence four of the five Cyber Essentials controls on managed devices: the Windows firewall, device locking and AutoPlay, update rings that install critical updates within 14 days,… Checked against Microsoft Intune with Windows 11 25H2 and iOS 26 devices (paths checked against Microsoft Learn), 2026-11. ## Operating system - [Windows 11](https://cyberessentialspreparation.com/setup/windows-11.md): A Windows 11 laptop or desktop meets Cyber Essentials when the Windows firewall is on for every profile, AutoPlay is off, the device locks and needs a 6-character PIN or password, Windows Update is… Checked against Windows 11 25H2 Pro (paths checked against Microsoft Support and Microsoft Learn), 2026-11. - [macOS](https://cyberessentialspreparation.com/setup/macos.md): A Mac meets Cyber Essentials when the built-in firewall is on, unused sharing services and the Guest account are off, the screen locks and requires a password, Software Update installs macOS and… Checked against macOS 26 (Tahoe) and macOS 15 (Sequoia) (paths checked against Apple Support), 2026-11. ## Mobile - [iOS and iPadOS](https://cyberessentialspreparation.com/setup/ios-and-ipados.md): An iPhone or iPad meets Cyber Essentials when it runs an iOS or iPadOS version Apple still patches, has a passcode of at least 6 digits, installs updates automatically, and can only install approved… Checked against iOS 26 and iPadOS 26 (paths checked against Apple Support), 2026-11. - [Android](https://cyberessentialspreparation.com/setup/android.md): An Android phone meets Cyber Essentials when its manufacturer still issues security patches for that model, the screen lock needs a PIN or password of at least 6 characters, system and app updates… Checked against Android 16 on Pixel and Samsung One UI 8 (paths checked against Google and Samsung support pages), 2026-11. ## Endpoint security - [Microsoft Defender for Business](https://cyberessentialspreparation.com/setup/microsoft-defender-for-business.md): Defender for Business evidences malware protection option A for Cyber Essentials on Windows and macOS: real-time protection, automatic security intelligence updates, tamper protection and web… Checked against Defender for Business (Microsoft 365 Business Premium), 2026-11. ## Firewall - [Fortinet FortiGate](https://cyberessentialspreparation.com/setup/fortinet-fortigate.md): A FortiGate meets the Cyber Essentials firewall control when the default admin password is changed, administrative access from the internet is disabled or protected by MFA or trusted hosts, inbound… Checked against FortiOS 7.6 and 8.0 (paths checked against Fortinet documentation), 2026-11. - [Sophos Firewall (XGS)](https://cyberessentialspreparation.com/setup/sophos-firewall.md): A Sophos Firewall meets the Cyber Essentials firewall control when the default admin password is changed, WAN administrative access is disabled or limited by MFA and local service ACL exceptions,… Checked against SFOS 21.5 and 22 (paths checked against Sophos documentation), 2026-11. - [Cisco Meraki MX](https://cyberessentialspreparation.com/setup/cisco-meraki.md): A Meraki MX meets the Cyber Essentials firewall control when every Dashboard account uses two-factor authentication, local status page access is disabled or uses a unique password, inbound port… Checked against Current MX stable firmware, Meraki Dashboard (paths checked against Meraki documentation), 2026-11. - [DrayTek Vigor](https://cyberessentialspreparation.com/setup/draytek.md): A DrayTek Vigor router meets the Cyber Essentials firewall control when the admin password is changed from the default, management from the internet is switched off or limited to trusted IP… Checked against Vigor 2865 and 2927, firmware 4.4 and later (paths checked against DrayTek documentation), 2026-11. - [Ubiquiti UniFi (Dream Machine, Cloud Gateway)](https://cyberessentialspreparation.com/setup/ubiquiti-unifi.md): A UniFi gateway meets the Cyber Essentials firewall control when the UI account that owns the console uses MFA, remote management through the Ubiquiti cloud is off or protected by that MFA, port… Checked against UniFi Network 10, UniFi OS 4.4 and later (paths checked against Ubiquiti Help Center), 2026-11. - [WatchGuard Firebox](https://cyberessentialspreparation.com/setup/watchguard.md): A WatchGuard Firebox meets the Cyber Essentials firewall control when the default admin and status passphrases are changed, management from the External interface is removed or limited to trusted IP… Checked against Fireware 2026.1 and 12.11 (paths checked against WatchGuard Help Center), 2026-11. ## Cloud platform - [Microsoft Azure (IaaS)](https://cyberessentialspreparation.com/setup/azure.md): Azure virtual machines and their network boundary are in scope for Cyber Essentials as IaaS. You must evidence network security groups that block unauthenticated inbound traffic, MFA on every Azure… Checked against Azure portal (paths checked against Microsoft Learn), 2026-11. - [Amazon Web Services (IaaS)](https://cyberessentialspreparation.com/setup/aws.md): EC2 instances and their security groups are in scope for Cyber Essentials as IaaS. You must evidence security groups with no management ports open to the internet, MFA on the root user and every IAM… Checked against AWS Management Console (paths checked against AWS documentation), 2026-11.