Check your readiness
Operating system · Microsoft

Windows 11 settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Windows 11 25H2 Pro (paths checked against Microsoft Support and Microsoft Learn).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

A Windows 11 laptop or desktop meets Cyber Essentials when the Windows firewall is on for every profile, AutoPlay is off, the device locks and needs a 6-character PIN or password, Windows Update is on and not paused, the daily account is a standard user, and Defender Antivirus with SmartScreen is active and updating.

Key facts
Platform
Windows 11 (Microsoft)
Applies to
Windows 11 25H2 Pro (paths checked against Microsoft Support and Microsoft Learn)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
23 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Windows 11 for firewalls?

Apply 4 settings in Windows 11: turn the firewall on for every network profile, block inbound connections by default, use the Public profile on untrusted networks and review allowed apps. Together they provide evidence for A4.1.1 and A4.7.

A4.1.1 asks whether software firewalls are enabled on all computers. Windows Defender Firewall is the built-in answer. See the firewalls requirements for what the control asks.

  1. Turn the firewall on for every network profile

    A4.1.1
    Settings > Privacy & security > Windows Security > Firewall & network protection > Domain network, Private network, Public network: Microsoft Defender Firewall: On

  2. Block inbound connections by default

    A4.7
    Windows Security > Firewall & network protection > Advanced settings > Windows Defender Firewall Properties > Domain, Private and Public Profile tabs > Inbound connections: Block

  3. Use the Public profile on untrusted networks

    A4.1.1
    Settings > Network & internet > Wi-Fi or Ethernet > select the network > Network profile type: Public network

    The requirements call for a software firewall on devices used on public wifi; the Public profile is the stricter rule set.

  4. Review allowed apps

    A4.7
    Windows Security > Firewall & network protection > Allow an app through firewall > remove entries you do not recognise

A5: how do you configure Windows 11 for secure configuration?

Apply 5 settings in Windows 11: turn off AutoPlay, disable the Guest account, remove unnecessary software and features, require sign-in after sleep and set a lock timeout and set a PIN of at least 6 characters. Together they provide evidence for A5.8, A5.2, A5.1, A5.9 and A5.10.

Remove what you do not use, stop files running on their own, and make sure the device locks. See the secure configuration requirements for what the control asks.

  1. Turn off AutoPlay

    A5.8
    Settings > Bluetooth & devices > AutoPlay > Use AutoPlay for all media and devices: Off; on Pro also gpedit.msc > Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies > Turn off AutoPlay: Enabled (All drives)

  2. Disable the Guest account

    A5.2
    Computer Management (compmgmt.msc) > Local Users and Groups > Users > Guest > Properties > Account is disabled: ticked (or run: net user guest /active:no)

  3. Remove unnecessary software and features

    A5.1
    Settings > Apps > Installed apps > Uninstall; then remove unused features from the Optional features page in Settings

  4. Require sign-in after sleep and set a lock timeout

    A5.9
    Settings > Accounts > Sign-in options > Additional settings > If you've been away, when should Windows require you to sign in again?: When PC wakes up from sleep; Settings > System > Power & battery > Screen, sleep, & hibernate timeouts > Turn my screen off after and Make my device sleep after: 10 minutes or less

  5. Set a PIN of at least 6 characters

    A5.10
    Settings > Accounts > Sign-in options > PIN (Windows Hello) > Set up; on Pro enforce with gpedit.msc > Computer Configuration > Administrative Templates > System > PIN Complexity > Minimum PIN length: 6

    If the same password also signs in to the network or cloud, the full 8 or 12 character rule in A7.11 applies.

A6: how do you configure Windows 11 for security update management?

Apply 5 settings in Windows 11: confirm the build is in support, keep automatic updates on, including other Microsoft products, make sure updates are not paused, auto-update Microsoft Store apps and update or remove third-party applications. Together they provide evidence for A6.1, A2.6, A6.4.1, A6.5.1, A6.4, A6.5, A6.5.2 and A6.6.

Windows Update handles the operating system; Store and third-party apps need their own evidence. See the security update management requirements for what the control asks.

  1. Confirm the build is in support

    A6.1A2.6
    Settings > System > About > Windows specifications > Version (as of November 2026, Home and Pro need 25H2 or 26H2; Enterprise and Education 24H2 or later, because 23H2 Enterprise ends on 10 November 2026)

  2. Keep automatic updates on, including other Microsoft products

    A6.4.1A6.5.1
    Settings > Windows Update (check that updates are not paused) > Advanced options > Receive updates for other Microsoft products: On

  3. Make sure updates are not paused

    A6.4AUTO-FAIL
    Settings > Windows Update > Pause updates: not active (click Resume updates if it is)

    A five-week pause is enough to breach the 14-day rule on its own.

  4. Auto-update Microsoft Store apps

    A6.5.1
    Microsoft Store > Profile (your account photo) > Store Settings > App updates: On

  5. Update or remove third-party applications

    A6.5AUTO-FAILA6.5.2A6.6
    Settings > Apps > Installed apps (remove unsupported software); Terminal: winget upgrade --all --include-unknown (run weekly and keep the output)

A7: how do you configure Windows 11 for user access control?

Apply 5 settings in Windows 11: make the daily account a standard user, disable or secure the built-in Administrator, set account lockout to 10 attempts, set the minimum password length for local accounts and prefer Windows Hello sign-in. Together they provide evidence for A7.6, A7.7, A5.3, A7.2, A7.10, A7.11 and A5.10.

The daily account must be a standard user. Administration happens in a separate account with a strong, unique credential. See the user access control requirements for what the control asks.

  1. Make the daily account a standard user

    A7.6A7.7
    Settings > Accounts > Other users > select the account > Account options: Change account type > Standard User

    Create a separate local or Entra admin account first so you are not locked out.

  2. Disable or secure the built-in Administrator

    A5.3A7.2
    Computer Management > Local Users and Groups > Users > Administrator > Account is disabled: ticked (or set a unique 12+ character password)

  3. Set account lockout to 10 attempts

    A7.10
    Local Security Policy (secpol.msc) > Account Policies > Account Lockout Policy > Account lockout threshold: 10 invalid logon attempts, Account lockout duration: 15 minutes

    Check the current value on each device rather than assuming a default.

  4. Set the minimum password length for local accounts

    A7.11
    secpol.msc > Account Policies > Password Policy > Minimum password length: 12, Maximum password age: 0 (never expires)

  5. Prefer Windows Hello sign-in

    A7.11A5.10
    Settings > Accounts > Sign-in options > set up Windows Hello (PIN, face or fingerprint) and use it for everyday sign-in

A8: how do you configure Windows 11 for malware protection?

Apply 4 settings in Windows 11: turn on real-time and cloud protection, check protection updates are current, turn on SmartScreen for apps, files and browsing and consider Smart App Control on new installs. Together they provide evidence for A8.1, A8.2 and A8.3.

Defender Antivirus is built in and meets option A when real-time protection, cloud protection and SmartScreen are on. See the malware protection requirements for what the control asks.

  1. Turn on real-time and cloud protection

    A8.1A8.2
    Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings > Real-time protection: On, Cloud-delivered protection: On, Automatic sample submission: On, Tamper Protection: On

  2. Check protection updates are current

    A8.2
    Windows Security > Virus & threat protection > Virus & threat protection updates > Protection updates > Check for updates (note the Security intelligence version and date)

  3. Turn on SmartScreen for apps, files and browsing

    A8.3
    Windows Security > App & browser control > Reputation-based protection > Check apps and files: On, SmartScreen for Microsoft Edge: On, Phishing protection: On, Potentially unwanted app blocking: On, SmartScreen for Microsoft Store apps: On

  4. Consider Smart App Control on new installs

    A8.1
    Windows Security > App & browser control > Smart App Control settings > On

    Smart App Control blocks apps with no good reputation or valid signature. It is a useful extra layer, but it does not give you the actively approved application list that application allow listing (option B) requires, so rely on Defender Antivirus (option A) for A8.1 on Windows.

Which questions does this guide cover?

The 24 questions below are the ones Windows 11 can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.6Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.A6: Confirm the build is in support
A4.1.1Do you have software firewalls enabled on all of your computers, laptops and servers?A4: Turn the firewall on for every network profile; A4: Use the Public profile on untrusted networks
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Block inbound connections by default; A4: Review allowed apps
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Remove unnecessary software and features
A5.10Which method do you use to unlock the devices?A5: Set a PIN of at least 6 characters; A7: Prefer Windows Hello sign-in
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Disable the Guest account
A5.3Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?A7: Disable or secure the built-in Administrator
A5.8Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?A5: Turn off AutoPlay
A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?A5: Require sign-in after sleep and set a lock timeout
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Confirm the build is in support
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Make sure updates are not paused
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Keep automatic updates on, including other Microsoft products
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Update or remove third-party applications
A6.5.1Are all updates applied on your applications by enabling auto updates?A6: Keep automatic updates on, including other Microsoft products; A6: Auto-update Microsoft Store apps
A6.5.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?A6: Update or remove third-party applications
A6.6Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?A6: Update or remove third-party applications
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Set account lockout to 10 attempts
A7.11Which technical controls are used to manage the quality of your passwords within your organisation?A7: Set the minimum password length for local accounts; A7: Prefer Windows Hello sign-in
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A7: Disable or secure the built-in Administrator
A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?A7: Make the daily account a standard user
A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?A7: Make the daily account a standard user
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Turn on real-time and cloud protection; A8: Consider Smart App Control on new installs
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Turn on real-time and cloud protection; A8: Check protection updates are current
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Turn on SmartScreen for apps, files and browsing

What evidence should you keep for the assessor?

Keep the 6 dated records listed below for Windows 11. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Screenshot of Firewall & network protection showing all three profiles on.
  • Screenshot of Settings > System > About with the version and build.
  • Screenshot of Windows Update showing last checked date and no pause.
  • Screenshot of Settings > Accounts > Other users showing the daily account as Standard User.
  • Screenshot of Virus & threat protection settings and the security intelligence version.
  • Output of winget upgrade --all or the third-party patch tool report.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Yes. Home lacks Group Policy and BitLocker management but every control can still be met through Settings and Windows Security. Home and Pro get 24 months of updates per feature update: 24H2 Home and Pro ended on 13 October 2026, so they must now run 25H2 (to 12 October 2027) or 26H2 (to 10 October 2028).

No. Disk encryption is not a Cyber Essentials requirement. Device locking is. Turn BitLocker on anyway; it is good practice and often a client requirement, but it does not affect the assessment.

Yes, provided it is not used for email or browsing and has a unique password of at least 12 characters, or 8 with a deny list. Record it in your list of admin accounts for A7.8.

Four things on a sampled device. Test case 2 is an authenticated vulnerability scan that fails on any critical or high-risk fix available for more than 14 days. Test case 3 checks Defender blocks test malware by email and download. Test case 4 checks MFA on cloud sign-in. Test case 5 checks that running an admin task as the daily user triggers a separate admin login.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources