The five Cyber Essentials controls

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

What Cyber Essentials is

Cyber Essentials is a UK Government-backed cyber security certification scheme owned by the National Cyber Security Centre (NCSC) and delivered by IASME. It sets a practical baseline of five technical controls that protect organisations against the most common internet-borne cyber attacks, and is widely required for UK public sector tenders, defence contracts and cyber insurance renewals.

The five technical controls at a glance

Every question in the Cyber Essentials self-assessment and every test in a Cyber Essentials Plus audit maps to one of these five controls:

1. Firewalls

What it asks in plain words: Every computer, laptop, server and office network in scope must sit behind a properly configured firewall that blocks unapproved inbound connections from the internet. Default admin passwords on routers and firewalls must be changed, and the router’s admin page must not be open to the internet unless there is a documented business need protected by Multi-Factor Authentication (MFA) or an IP address allow-list.

Most common failure: Leaving the factory password on an office router, leaving a router’s web admin page reachable from the internet, or forgetting to switch on the built-in software firewall on macOS or Windows laptops used away from the office.

Read the full Firewalls guide →

2. Secure configuration

What it asks in plain words: Computers, phones and network equipment must be stripped of unnecessary user accounts and unused software, have all default passwords changed, have auto-run disabled, and lock with a PIN, password (at least 6 characters if used only for device unlock) or biometric protected against brute-force guessing (no more than 10 guesses in 5 minutes, or locking after 10 failed attempts).

Most common failure: Staff using personal or company mobile phones for work email with no screen lock enforced, old guest or ex-employee accounts still enabled on shared PCs, or network printers left on default passwords.

Read the full Secure configuration guide →

3. Security update management

What it asks in plain words: All operating systems, router and firewall firmware, applications, browser extensions and plugins in scope must be licensed, supported by their vendor, set to update automatically where possible, and updated within 14 days whenever a critical or high-risk security fix (Common Vulnerability Scoring System (CVSS) v3 score of 7.0+, or unrated) is released.

Most common failure: Windows 10 PCs without Extended Security Updates (ESU), Office 2016/2019 still installed after October 2025 end of support, routers on neglected firmware, or third-party desktop apps (like Adobe Reader, Chrome or Zoom) left past the 14-day window — both 14-day patching checks are now automatic fails.

Read the full Security update management guide →

4. User access control

What it asks in plain words: Every user must have a unique account approved through a formal process, with only the access their job requires. Administrator accounts must be separate from everyday accounts and never used for email or web browsing. Leavers’ accounts must be disabled or removed promptly, and Multi-Factor Authentication (MFA) must be enabled on every cloud service where available.

Most common failure: Missing MFA on a secondary cloud service (such as Xero, CRM or HR software, which is now an automatic fail), directors using a Microsoft 365 Global Administrator account for daily email, or staff working in local admin accounts on their laptops.

Read the full User access control guide →

5. Malware protection

What it asks in plain words: Every device in scope must be protected by either active, self-updating anti-malware software (on Windows and macOS, including web protection that blocks connections to malicious websites) or strict application allow-listing (where only approved, code-signed apps can run, including on phones and tablets).

Most common failure: Macs with no anti-malware agent installed, Windows Defender disabled by an expired third-party antivirus trial, or unmanaged personal phones installing apps from outside official stores.

Read the full Malware protection guide →

What sits around the five controls: scope, cloud services and backups

Before the five controls are marked, three cross-cutting rules in Requirements for IT Infrastructure v3.3 shape your assessment:

• Scope: You must certify either your whole organisation or a network-segregated sub-set, and list every legal entity included by name, address and company number. End-user devices can never be left out.
• Cloud services: v3.3 defines a cloud service as any on-demand internet service accessed via an account (company credentials or a business email address) that stores or processes organisational data. Cloud services cannot be excluded from scope.
• Backups: Backing up data is not one of the five mandatory technical controls, so you cannot fail Cyber Essentials solely for lacking a backup. However, Section C of v3.3 strongly emphasises keeping regular offline or cloud backups — and disconnecting USB or external hard drives when a backup is not running — so you can recover if ransomware or hardware failure strikes.

This year’s three automatic failures

Under the April 2026 Danzell marking rules, failing any of these three items fails your entire assessment outright: (1) missing MFA on any cloud service where it is available (free or paid), (2) missing the 14-day deadline for critical operating system or router/firewall firmware updates, or (3) missing the 14-day deadline for critical application and extension updates. See What changed in Cyber Essentials for 2026 (Danzell).

How the five controls map to Microsoft 365