Secure configuration: what Cyber Essentials needs

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Why out-of-the-box settings fail Cyber Essentials

New laptops, phones, servers and network equipment arrive configured for convenience rather than security: pre-installed trial software, enabled guest accounts, auto-play features that launch files without asking, and factory default passwords. Section E.2 of the NCSC Requirements for IT Infrastructure v3.3 requires you to harden those defaults across every device and cloud service in scope.

The six secure configuration requirements

1. Remove or disable unnecessary user accounts: Disable built-in guest accounts, local test accounts, and any administrative or user accounts that are not needed.
2. Change all default or guessable passwords: Every router, printer, server, phone system or software application that ships with a default password (such as admin/admin) must have it changed before going live.
3. Remove or disable unnecessary software and services: Uninstall pre-installed consumer trialware (“bloatware”), unused browser toolbars, old utilities and network services that the device does not need for its business role. Every piece of software left installed is another item you must patch within 14 days.
4. Disable auto-run and auto-play features: Switch off any feature that executes files or code automatically without the user’s explicit authorisation — both when a USB stick or external drive is plugged in, and when files are downloaded in a browser.
5. Require authentication before accessing organisational data: No one should be able to walk up to a device or open a network share and reach business emails or documents without logging in.
6. Enforce device unlocking credentials and brute-force protection: Every laptop, desktop, tablet and smartphone must lock and require a credential to unlock.

Exact v3.3 numbers for device PINs, passwords and lockouts

Section E.2 (page 16 of v3.3) sets specific numbers for unlocking physical devices (such as waking a laptop or unlocking a mobile phone):

• Accepted unlock methods: Biometric authentication (such as Windows Hello face/fingerprint, Touch ID or Face ID), a password, or a PIN.
• Minimum PIN or password length for device unlocking: At least 6 characters where the credential is used only to unlock the physical device (for example, a 6-digit iPhone/Android passcode or a 6-digit Windows Hello PIN). If the credential is also used to authenticate to an account or network (such as a standard Windows password with no separate PIN), it must meet the full account password rules in Passwords and device locking (at least 8 characters with MFA or a deny list, or 12+ characters).
• Brute-force protection (10 attempts rule): Where configurable, you must either:
  • Throttle the rate of attempts so the wait time increases with each wrong guess, allowing no more than 10 guesses in 5 minutes, or
  • Lock the device after no more than 10 unsuccessful attempts.
  Where a hardware vendor does not allow you to change the lockout threshold, you must use the vendor’s default brute-force setting (for example, iOS and iPadOS enforce escalating time delays automatically).