# Five Controls (https://five-controls.co.uk)

> Practical Cyber Essentials help for UK small businesses running on Microsoft 365. Updated for the April 2026 NCSC Requirements for IT Infrastructure v3.3 and IASME Danzell question set.

## Who runs Five Controls
- Operated openly by AlphaSec (https://alphasec.uk/), a trading name of Alphabyte IT Limited (company no. 07014261), 9/10 Connies House, Rhymney River Bridge Road, Cardiff CF23 9AF.
- Author: Ross Owen, Founder and CEO, Alphabyte IT (https://www.alphabyte.it/).
- Track record: Looking after UK businesses since 2009, Microsoft Partner, Cyber Essentials certified, managing ~60 Microsoft 365 tenants. None of the clients we have prepared for Cyber Essentials has ever failed.
- Contact: 029 2240 4615 | hello@five-controls.co.uk | https://five-controls.co.uk/get-help/
- Independence: Independent of the NCSC and IASME. Tools give an indication only and are not an official assessment or certification.

## All pages and tools
- [Cyber Essentials, made practical for Microsoft 365 businesses](https://five-controls.co.uk/): Free, practical help with Cyber Essentials. Check whether you'd auto-fail under the 2026 rules, then fix it with step-by-step Microsoft 365 guides.
- [Who runs Five Controls](https://five-controls.co.uk/about/): Five Controls is a free Cyber Essentials resource run by AlphaSec, part of Alphabyte IT, a Microsoft Partner looking after UK businesses since 2009.
- [Get help with Cyber Essentials](https://five-controls.co.uk/get-help/): Fixed-price Cyber Essentials preparation for Microsoft 365 businesses from a team whose clients have never failed. Remote UK-wide. Free 20-minute call.
- [Contact us](https://five-controls.co.uk/contact/): Questions about Cyber Essentials or our tools? Call 029 2240 4615 or send us a message.
- [Free Cyber Essentials tools](https://five-controls.co.uk/tools/): Free tools to get ready for Cyber Essentials: an auto-fail checker, a scope builder, a policy pack and a renewal reminder.
- [Would you fail Cyber Essentials? Find out in 10 minutes](https://five-controls.co.uk/tools/auto-fail-checker/): Answer 25 quick questions and see which areas would auto-fail or be marked down under the 2026 Cyber Essentials rules, with the fix for each. Free.
- [Build your Cyber Essentials scope](https://five-controls.co.uk/tools/scope-builder/): Work out what's in scope for Cyber Essentials, from legal entities to cloud services and home workers. Get a scope summary to use in your assessment.
- [Get your Cyber Essentials evidence pack](https://five-controls.co.uk/tools/evidence-pack/): Answer a few questions and download editable security policies and registers written for small businesses working towards Cyber Essentials.
- [Never let your Cyber Essentials lapse](https://five-controls.co.uk/tools/renewal-reminder/): Certificates last 12 months. Tell us your date and we'll remind you 90, 60 and 30 days before, with what changed in the rules since you last certified.
- [The five Cyber Essentials controls](https://five-controls.co.uk/controls/): Firewalls, secure configuration, updates, user access and malware protection: what each Cyber Essentials control asks, what fails, and how to fix it.
- [Firewalls: what Cyber Essentials needs](https://five-controls.co.uk/controls/firewalls/): What Cyber Essentials needs from your router, office firewall and laptop firewalls, the mistakes that fail assessments, and how to fix them.
- [Secure configuration: what Cyber Essentials needs](https://five-controls.co.uk/controls/secure-configuration/): Remove what you don't use, change default passwords, lock devices and stop auto-run. What Cyber Essentials expects, with the exact settings.
- [Security updates: the control that now fails you outright](https://five-controls.co.uk/controls/security-updates/): Under Danzell, late critical updates fail you outright. What counts as critical, the 14-day rule, unsupported software, and how to automate it.
- [User access control: what Cyber Essentials needs](https://five-controls.co.uk/controls/user-access-control/): Who can log in to what, with which rights. MFA, separate admin accounts, leavers and passwords: what Cyber Essentials needs and how to set it up.
- [Malware protection: what Cyber Essentials needs](https://five-controls.co.uk/controls/malware-protection/): What Cyber Essentials needs from anti-malware or app allow-listing, whether Microsoft Defender is enough, and how to cover Macs, phones and tablets.
- [MFA and Cyber Essentials: the rule that now fails you outright](https://five-controls.co.uk/requirements/mfa/): Missing MFA on any cloud service that offers it now fails Cyber Essentials outright, even if MFA is a paid extra. What counts and how to fix it.
- [Which cloud services count for Cyber Essentials?](https://five-controls.co.uk/requirements/cloud-services/): Cloud services can't be left out of Cyber Essentials. The v3.3 definition in plain English, plus a checklist to find every service your staff use.
- [Cyber Essentials scope: what's in and what's out](https://five-controls.co.uk/requirements/scope/): Getting scope wrong is a common reason for failing. Whole organisation or part, legal entities, exclusions and segregation under the 2026 rules.
- [Personal devices (BYOD) and Cyber Essentials](https://five-controls.co.uk/requirements/byod/): If staff use their own phones or laptops for work email or files, those devices are in scope. What that means, and three practical ways to handle it.
- [Home and hybrid workers and Cyber Essentials](https://five-controls.co.uk/requirements/home-workers/): Home routers, laptops on home Wi-Fi and personal devices: what's in scope for home workers under Cyber Essentials and how to protect them.
- [Admin accounts: what Cyber Essentials allows](https://five-controls.co.uk/requirements/admin-accounts/): Using an admin account for email is a common reason firms fail. How to separate admin accounts in Microsoft 365 and on laptops without slowing staff down.
- [Unsupported software: what fails Cyber Essentials](https://five-controls.co.uk/requirements/unsupported-software/): Windows 10, old Office versions and end-of-life apps can fail your Cyber Essentials. How to find them and what to do: upgrade, remove or isolate.
- [The 14-day patching rule](https://five-controls.co.uk/requirements/14-day-patching/): High-risk and critical updates must go in within 14 days or you fail outright. What counts, when the clock starts, and how to prove you're doing it.
- [Cyber Essentials password and PIN requirements](https://five-controls.co.uk/requirements/passwords/): Minimum lengths, MFA, deny lists, lockouts and passkeys: the Cyber Essentials password rules in plain English, with Microsoft 365 settings.
- [Cyber Essentials for Microsoft 365: every setting that matters](https://five-controls.co.uk/microsoft-365/): Every Cyber Essentials requirement mapped to the Microsoft 365 setting that meets it: MFA, Conditional Access, Intune, Defender and licence notes.
- [Conditional Access and MFA for Cyber Essentials](https://five-controls.co.uk/microsoft-365/conditional-access/): Security defaults or Conditional Access? The policies a small business needs to meet the Cyber Essentials MFA rule, with break-glass accounts done right.
- [Intune and Defender settings for Cyber Essentials](https://five-controls.co.uk/microsoft-365/intune-defender/): The Intune and Defender for Business policies that cover updates, firewalls, anti-malware, device locking and admin rights for Cyber Essentials.
- [Do you need Microsoft 365 Business Premium for Cyber Essentials?](https://five-controls.co.uk/microsoft-365/business-premium/): The honest answer: not strictly, but it makes passing and staying compliant far easier. What Business Standard can and can't do, and what upgrading adds.
- [Your insurer wants Cyber Essentials. Here's what to do.](https://five-controls.co.uk/why/insurance/): Insurers increasingly ask about Cyber Essentials at renewal. What they look for, how long certification takes, and how to pass before your renewal date.
- [Cyber Essentials for government and public sector contracts](https://five-controls.co.uk/why/public-sector-contracts/): When public sector buyers require Cyber Essentials or Cyber Essentials Plus, what PPN 014 says, and how to get certified in time for a tender deadline.
- [Defence suppliers: Cyber Essentials and DCC Level 0](https://five-controls.co.uk/why/defence/): The MOD asks suppliers to reach Defence Cyber Certification Level 0 by the end of 2026, with Cyber Essentials at its core. What that means for suppliers.
- [A customer sent you a security questionnaire. Now what?](https://five-controls.co.uk/why/customer-questionnaire/): How to answer a customer's supplier security questionnaire, what Cyber Essentials covers, and why certifying can save you filling in the next one.
- [How much does Cyber Essentials cost?](https://five-controls.co.uk/cost/): The IASME fee by organisation size, what preparation and fixes really cost, and how Cyber Essentials Plus pricing works. Honest numbers, no surprises.
- [Cyber Essentials or Cyber Essentials Plus?](https://five-controls.co.uk/cyber-essentials-vs-plus/): Basic is a verified self-assessment; Plus adds a hands-on technical audit. The differences, costs, timing and the 2026 changes that make Plus stricter.
- [How long does Cyber Essentials take?](https://five-controls.co.uk/how-long/): From a few days to a few months. A realistic Cyber Essentials timeline, what slows firms down, and the fastest safe route when a deadline is close.
- [Why firms fail Cyber Essentials](https://five-controls.co.uk/why-firms-fail/): The most common reasons firms fail Cyber Essentials, from missing MFA to the wrong scope, what happens if you fail, and how to pass first time.
- [What changed in Cyber Essentials for 2026 (Danzell)](https://five-controls.co.uk/whats-changed/): What changed in Cyber Essentials on 27 April 2026: the new auto-fail rules on MFA and patching, scope changes, and stricter Cyber Essentials Plus testing.
- [Why do you need Cyber Essentials?](https://five-controls.co.uk/why/): Insurers, public sector buyers, defence customers and clients all ask for Cyber Essentials. Find your reason and what to do this week.