Cyber Essentials Readiness Checklist: Checks and Evidence Before You Submit

Most organisations that struggle with Cyber Essentials do not fail on the five controls themselves, they fail on scope: a forgotten cloud service, a home worker's laptop, an unsupported operating system on one machine or an admin account that also reads email. This checklist helps a small or medium organisation confirm it is ready to submit the Cyber Essentials self-assessment, and to book Cyber Essentials Plus testing with confidence. It follows the NCSC document Cyber Essentials: Requirements for IT Infrastructure, version 3.3 (April 2026), and lists each check in the order an assessor will look at it, with the evidence to have ready. It is written for the person preparing the submission, often an office manager, IT lead or managed service provider, and for the board member who must sign it off. For what the scheme is and why it matters, see the Cyber Essentials Guide.

How to use this template

• Replace text in square brackets, such as [Organisation], [IT lead], [MSP] and [Certification Body], with your own details.
• Work through sections 1 to 8 in order. Section 1 (scope) decides which devices, accounts and services every later check applies to, so agree it first.
• For each check record an owner, a status (Ready, Gap, Not applicable) and where the evidence lives. "Not applicable" needs a reason you could explain to an assessor.
• Requirement values below come from the NCSC Requirements for IT Infrastructure v3.3, dated April 2026. The scheme is updated regularly, so confirm the current requirements document and question set on the NCSC and IASME sites before you start.
• Start at least [eight] weeks before you need the certificate. Gaps in patching and unsupported software usually take longest to fix, because they can mean buying hardware.

1. Scope and boundary

• [Organisation] has decided whether to certify the whole organisation or a well-defined, separately managed sub-set. A sub-set must be segregated from the rest of the network by a firewall or VLAN.
• The scope statement names the business unit, the network boundary and the physical locations, and has been agreed with [Certification Body] before the assessment.
• End user devices are included. A scope that leaves out laptops, desktops, tablets and phones is not acceptable.
• Every cloud service that stores or processes organisational data, or supports its services, is listed. Version 3.3 states that cloud services cannot be excluded from scope.
• Bring your own device (BYOD) phones and laptops that reach organisational email, files or apps are listed as in scope. Devices used only for native voice, native text or an MFA app are out of scope. See the BYOD Policy Template.
• Home and remote workers' devices, corporate or BYOD, are in scope. A router supplied by [Organisation] is in scope; a personal home router is not, which means a software firewall must be on the device.
• Accounts owned by [Organisation] but used by suppliers or [MSP] are in scope, as are company devices on loan to third parties.
• Thin clients, servers, network devices and wireless access points that can reach the internet are listed.

2. Roles, route and sign-off

• A named person, [IT lead], owns the submission and has access to the question set. IASME publishes a free preview of the questions; download it and draft answers offline first.
• The route is chosen: self-led (register and pay through IASME, then complete the verified self-assessment) or supported (a Certification Body licensed by IASME helps you interpret questions and check readiness).
• A board member or equivalent has agreed to sign off the answers and understands that the declaration is theirs, not [MSP]'s.
• Budget is approved. IASME lists Cyber Essentials fees by size, from £320 plus VAT for micro organisations (0 to 9 employees) up to £600 plus VAT for 250 or more; Cyber Essentials Plus is quoted on size and complexity.
• Where [MSP] manages devices or cloud tenants, it has confirmed in writing which controls it operates and has supplied the evidence you will need. See the Choosing a Secure MSP for Small Business Guide.
• If turnover is under £20 million and you certify the whole organisation, you have checked the cyber liability insurance that IASME arranges for eligible organisations and decided whether to take it up.

3. Firewalls

• Every in-scope device sits behind a correctly configured firewall or network device with firewall functionality, or has its own software firewall enabled.
• Default administrative passwords on routers and firewalls have been changed to strong, unique passwords, or remote administration has been disabled.
• The firewall admin interface is not reachable from the internet. If there is a documented business need, it is protected by MFA, or by an IP allow list together with a managed password approach.
• Unauthenticated inbound connections are blocked by default. Each inbound rule has a recorded business need and an approver, and rules no longer needed have been removed. See the Firewall Rule Review Checklist.
• Laptops used on untrusted networks such as public Wi-Fi have the host firewall turned on and locked so users cannot disable it. See the Host-Based Firewall Guide.

4. Secure configuration

• Unnecessary user accounts, including guest accounts and unused administrator accounts, have been removed or disabled on every device and service.
• Default or guessable passwords have been changed everywhere, including printers, NAS boxes and cloud admin consoles.
• Software, utilities and network services that are not needed have been removed or disabled.
• Auto-run (any feature that runs files without the user's authorisation) is disabled, for example AutoPlay and AutoRun for removable media on Windows.
• Users must authenticate before they can reach organisational data or services.
• Devices that need physical presence to unlock use a biometric, password or PIN. Unlock-only PINs and passwords are at least 6 characters, and devices allow no more than 10 guesses in 5 minutes or lock after more than 10 failed attempts, where the setting is configurable.
• Configuration is applied centrally (for example by an MDM or group policy) rather than by hand, so new devices start compliant. See the Small Business Device Management Guide.

5. Security update management

• All in-scope software is licensed and supported by its vendor. Operating systems, browsers, office suites, firmware on routers and phone operating systems are all checked against the vendor's support dates. See the Operating System End of Life and Extended Support Guide.
• Unsupported software has been removed, or the devices that need it have been moved into a sub-set that blocks all internet traffic and is excluded from scope.
• Automatic updates are enabled wherever possible.
• Updates are installed within 14 days of release when the vendor rates the fix "critical" or "high risk", when it fixes a vulnerability with a CVSS v3 base score of 7 or above, or when the vendor gives no severity. If a combined update contains any such fix, the whole update is applied within 14 days.
• Fixes that need manual configuration changes rather than a software update are tracked under the same 14-day rule.
• [Organisation] can show a patch report for each device type, dated within the last 14 days, as evidence. See the Patch Management Guide.

6. User access control

• A documented process creates and approves user accounts, and removes or disables them when someone leaves or after a defined period of inactivity.
• Every user has a unique account; shared logins have been replaced.
• Administrators use separate admin accounts for admin work only. Those accounts are not used for email, web browsing or other everyday tasks.
• Special privileges are removed when someone changes role.
• MFA is enabled for every cloud service wherever it is available, and always for administrator accounts and accounts reachable from the internet. Check each SaaS application, not just the email tenant. See the MFA Guide.
• Password-only accounts meet one of the password quality options: a minimum of 12 characters with no maximum length, or a minimum of 8 characters with no maximum length plus automatic blocking of common passwords through a deny list.
• Password-based logins are protected against guessing by MFA, by throttling to no more than 10 guesses in 5 minutes, or by locking after no more than 10 failed attempts.
• Where MFA is used, the password element is at least 8 characters with no maximum length. Regular forced expiry and complexity rules have been dropped in favour of helping users choose unique passwords, for example with a password manager. See the Password Policy Guide.
• Passwordless options (FIDO2 security keys, biometrics, push and one-time codes) are recognised in v3.3 and can be used where the service supports them.

7. Malware protection

• Every in-scope device has an active malware protection mechanism, using at least one of the two options in the requirements.
• Anti-malware software: on Windows and macOS servers, desktops and laptops it updates as the vendor recommends, prevents malware from running, prevents execution of malicious code and blocks connections to malicious websites.
• Application allow listing: applications are approved before deployment, a current list of approved applications is maintained, and execution is restricted to code-signed applications, so users cannot install unsigned or invalidly signed software. See the Application Allowlisting Guide.
• Phones and tablets rely on the official app store and the platform's built-in protections, with installation from unknown sources disabled.
• Users cannot turn off the malware protection.

8. Evidence pack and Cyber Essentials Plus readiness

• If you are going for Cyber Essentials Plus, expect a Certification Body to test a sample of devices, internet gateways and internet-facing servers. Run your own check first on a few typical devices: are they patched, does the anti-malware block a test file, does MFA prompt on every cloud service.
• Answers describe what is true today, not what is planned. Fix gaps before submitting; the self-led route gives up to six months to complete the assessment.
• The certificate is valid for 12 months. Put the renewal date and a re-run of this checklist in the calendar [two] months ahead.

Implementation guidance

Fix in this order, because each step makes the next one easier: (1) build the inventory and agree scope, (2) remove or isolate unsupported software and hardware, (3) turn on MFA for every cloud service and split admin accounts, (4) centralise patching and device configuration, (5) close firewall rules, (6) confirm malware protection. Most small organisations find steps 2 and 3 are where nearly all the work sits.

• Small organisations (under 10 staff): whole-organisation scope is usually simplest. A business-grade cloud email and file suite with built-in device management covers much of sections 4 to 7 if it is switched on.
• Larger or mixed estates: a sub-set can certify one business unit first, but the segregation must be real and an unsupported system in the wider network must not have a route into it.
• Testing changes: pilot MFA and patch policy changes on a small group for a week before rolling them out to everyone, and keep a documented way back (for example the previous MDM policy) in case a business application breaks.
• Where identity fits: the most common access control gaps are service and supplier accounts, such as an MSP's admin login or an accounting integration with a stored password. They are in scope because the organisation owns them. Give each one an owner and MFA or a scoped token. See the GDAP and MSP Delegated Admin Access Guide.

Measure readiness with a few numbers you can track week by week: percentage of in-scope devices on a supported OS; percentage of critical and high updates applied within 14 days; number of cloud services without MFA; number of admin accounts also used for email; and number of devices without active malware protection. Each should reach 100 per cent or zero before you submit.

Mapping to other frameworks: the scope and inventory checks support NIST CSF 2.0 ID.AM and NIST SP 800-53 CM-8; firewalls map to SC-7; secure configuration to CM-6 and CM-7; update management to SI-2; user access control to AC-2, AC-6, IA-2 and IA-5 (CSF PR.AA); malware protection to SI-3.

Sources: NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 · NCSC: Cyber Essentials Requirements for IT Infrastructure v3.2 · NCSC: Cyber Essentials Overview · IASME: Cyber Essentials

This checklist is provided for guidance, must be adapted to your organisation and does not replace the official requirements or question set. Related NHI Mgmt Group resources: Cyber Essentials Guide · Patch Management Policy Template · Free Cyber Security Services for Small Organisations Guide · SOC 2 Readiness Checklist