Cyber Essentials
By Jonathan Krause, Founder & Lead Cyber Essentials Assessor, Forensic Control.
Revised and updated on 25th August 2026.
The five controls of Cyber Essentials are
They are the five technical control themes set out in the Cyber Essentials Requirements for IT Infrastructure, the document published by the National Cyber Security Centre (NCSC) that every UK certification is assessed against, and an organisation has to satisfy all five to certify. The current version of that document is v3.3, published in April 2026 and applying to assessments from 27 April 2026.
This guide is for the person who has been asked to get their organisation certified and needs to know what each control requires. I have set out the objective of each control in the terms the requirements document uses, the thresholds an assessor will test against, and the points where v3.3 tightened what came before. The certification process, what it costs and how to answer the questionnaire have separate guides, linked where they are relevant.
The firewall control exists so that only secure and necessary network services can be reached from the internet, which is the objective the requirements document sets for it. Every device in scope sits behind a properly configured firewall or a network device performing the same function, and that includes laptops that leave the office for networks you do not control. Where a device regularly joins an untrusted network such as hotel WiFi, the software firewall on the device is what satisfies this rather than the one back at the office.
The detail that catches organisations out sits on the administrative side. Default administrative passwords are changed to something strong and unique or remote administrative access is disabled, and the administrative interface should not be reachable from the internet unless it is protected by multi-factor authentication (MFA) or by an allow list of internet protocol addresses combined with strong password authentication. Unauthenticated inbound connections are blocked by default, and any rule opening one is approved and documented with the business reason recorded alongside. A rule base carrying entries nobody can now account for is the version of this control I would expect an assessor to question first.
Secure configuration asks you to strip devices and network equipment back to what they are actually for, so the services running on them are the ones the role requires and no more. That means removing or disabling accounts nobody needs, changing default or guessable passwords, taking off software and services not in use, turning off auto-run features, and requiring users to authenticate before they reach organisational data.
Device unlocking is where this control gets specific. A credential is required for physical access to a device, whether that is a biometric, a password or a personal identification number (PIN), and it has to be protected against someone guessing repeatedly, either by throttling attempts to no more than ten guesses in five minutes or by locking the device after no more than ten unsuccessful attempts. The minimum length for a device unlocking credential is six characters, and that lower figure applies to unlocking only. Where the same credential also authenticates the user into the organisation’s data, the full password requirements under user access control apply instead.
Security update management is the control that older guidance still calls patch management, a name the current requirements document has moved away from. Its objective is that devices and software are not left vulnerable to known security issues for which fixes already exist. Everything in scope has to be licensed and supported, so software the vendor has stopped issuing fixes for either comes off the device or out of scope through a properly defined sub-set.
The fourteen day rule is the number an assessor will test you against. Updates that fix vulnerabilities are installed within fourteen days of release where the vendor describes the vulnerability as critical or high risk, where it carries a Common Vulnerability Scoring System (CVSS) version 3 base score of seven or above, or where the vendor has not stated a severity level at all. That third limb is the one organisations tend to read past, because an update with no stated severity falls inside the fourteen day window rather than outside it.
Version 3.3 raised the stakes here by making two of this control’s questions automatic failures rather than points weighed in the round. One covers high risk and critical updates for operating systems and for router and firewall firmware, the other applications together with their associated files and extensions. Missing either window now fails the assessment outright, and the firmware limb is the one I would check first, since router and firewall updates are often the ones nobody has been made responsible for.
User access control makes sure accounts belong to identified individuals and reach only what the person’s role requires. There has to be a process for creating and approving accounts, users authenticate with credentials unique to them, and accounts are removed or disabled when no longer needed or after a defined period of inactivity. Administrative work is done from separate accounts used for nothing else, which rules out email and web browsing from an account holding those privileges.
The change that matters most in v3.3 sits here. MFA has to be in place wherever it is available, and authentication to cloud services must always use it, so an organisation that has left MFA switched off on a cloud service offering it fails the assessment automatically, including where the feature is free or already part of the subscription. Version 3.3 also defines a cloud service for the first time, as an on-demand, scalable service hosted on shared infrastructure and accessible via the internet, which is broad enough to cover most of what an organisation logs into.
The hour of work this justifies is an audit of every cloud service your organisation logs into with business credentials. Microsoft 365, Google Workspace, Xero, Slack and Salesforce are the usual five, and the real list is longer than the one most people can recite from memory. Where MFA is available and switched off, switch it on. Where a second factor is already in place, check it against the four the requirements document recognises alongside a password of at least eight characters: a managed or enterprise device, an application on a trusted device, a physically separate token, or a known and trusted account.
Password quality is met in one of three ways: MFA, a minimum of eight characters with common passwords blocked through a deny list, or a minimum of twelve characters. None of the three sets a maximum length, and the requirements part company with a good deal of internal policy by telling you not to enforce regular expiry and not to enforce complexity rules. Passkeys built on public key cryptography, including authenticators following the FIDO2 standard, count as multi-factor authentication in their own right, so an organisation moving to passkeys is satisfying this control rather than working around it.
Malware protection is there to stop known malware and untrusted software running, causing damage or reaching data. The requirements ask for at least one mechanism on every device in scope, kept active and updated, and they offer two ways to satisfy it. Anti-malware software is the route most organisations running Windows and macOS devices take, configured to update in line with vendor recommendations, to prevent malware running, to prevent malicious code executing, and to prevent connections to malicious websites. That last item is worth checking on its own, because web protection is frequently a separate setting from the scanning engine rather than part of it.
The alternative is application allow listing, where only approved applications restricted by code signing are able to run. That means approving applications before they are deployed, keeping a current list of what is approved, and making sure users cannot install anything unsigned or carrying an invalid signature. It is more work to set up and less to defend at assessment, and it suits a tightly controlled device estate better than one where people install their own tools.
The five controls are firewalls, secure configuration, security update management, user access control and malware protection. They are set out in the Cyber Essentials Requirements for IT Infrastructure, the document UK certifications are assessed against, and an organisation has to meet all five to certify. Two of them are still widely quoted under older names, internet gateways and patch management, which the current requirements document no longer uses.
Version 3.3 of the Cyber Essentials Requirements for IT Infrastructure, published in April 2026 and applying to assessments from 27 April 2026. The accompanying question set was published on 13 February 2026 and is known within the assessor community as Danzell, the internal name for the platform’s current question set. The five controls themselves did not change at v3.3, but several of the requirements sitting under them did.
Yes. Multi-factor authentication is required wherever it is available, and authentication to cloud services must always use it. Since version 3.3, an organisation that has not enabled multi-factor authentication on a cloud service offering it fails the assessment automatically, and that applies even where the feature is free or already included in the subscription.
An update counts as critical or high risk where the vendor describes the vulnerability that way, where it carries a Common Vulnerability Scoring System version 3 base score of seven or above, or where the vendor has not stated a severity level at all. Updates in any of those three categories are installed within fourteen days of release. Since version 3.3, missing that window on operating systems, on router and firewall firmware, or on applications and their extensions fails the assessment.
It depends which of the three permitted approaches you use. With multi-factor authentication in place there is no separate character minimum. With a deny list blocking common passwords the minimum is eight characters. Without either, the minimum is twelve. None of the three permits a maximum length, and a device unlocking credential such as a PIN has a lower minimum of six characters that applies to unlocking the device only.
Safeguard your business with our expert cyber security solutions. Whether you require digital forensics, penetration testing or proactive security assessments, our team is ready to assist. Contact us today to discuss your security needs and take the first step towards a more secure future.
