What are the five controls of Cyber Essentials?

This October marks Cyber Security Awareness Month 2025, an annual opportunity to spotlight the importance of protecting data, people, and organisations from evolving digital threats. One of the most effective frameworks for building strong defences is Cyber Essentials, a UK government–backed certification that helps businesses guard against the most common cyber attacks.

The Cyber Essentials scheme focuses on five key technical controls that, when properly implemented, can prevent around 80% of cyber incidents. At Forensic Control, we help organisations understand, apply, and verify these controls to achieve lasting cyber resilience.

1. Firewalls and Internet Gateways
Firewalls are your network’s first line of defence, controlling and filtering traffic to block unauthorised access. Ensuring proper configuration helps keep attackers out while allowing safe, essential communication.

2. Secure Configuration
Default device and software settings often prioritise convenience over security. Secure configuration means disabling unnecessary features, removing unused accounts, and enforcing strong password policies to minimise vulnerabilities.

3. User Access Control
Only those who need access should have it. Following the principle of least privilege ensures users operate with minimal rights, reducing the risk of internal misuse or credential-based attacks.

4. Malware Protection
Effective anti-malware tools and user awareness prevent infections from ransomware, spyware, and trojans. Keeping software updated and educating staff on phishing attacks are vital parts of this defence.

5. Patch Management
Outdated software is a hacker’s best friend. Regularly applying patches and removing unsupported systems closes known security gaps and strengthens protection.

Implementing these five controls not only safeguards your business but also demonstrates your commitment to cybersecurity best practice.At Forensic Control, we make achieving Cyber Essentials certification simple, effective, and aligned with your business goals.