Are we actually ready for
Cyber Essentials?
A pre-assessment checklist for UK SMEs before you submit or pay for assessment. Most failures happen in scope, accounts, and MFA not because the controls are technically difficult, but because the stated answer does not match the operational reality. This checklist surfaces that gap.
This checklist is read-only and not a certification service. Use it to confirm your operational reality before you pay for assessment.
What Cyber Essentials actually tests
- Cyber Essentials is not advanced security. It tests basic control discipline across five technical areas: firewalls, secure configuration, user access control, malware protection, and patch management.
- Most SMEs do not fail because the controls are technically hard. They fail because the stated answer does not match reality: shadow devices outside the asset register, accounts that should have been closed, MFA that is switched on in policy but not enforced by conditional access, and endpoint protection that covers most but not all devices.
- The assessor sees what your systems report, not what you believe is true. This pre-check is designed to surface that gap before submission.
Can you list every device in scope with confidence?
Scope failures are the most common cause of reassessment. A device you forgot, a laptop used by a contractor, or a mobile phone with business email counts as in scope whether you listed it or not.
The list includes the device owner or assigned user, the operating system and version, and whether the device is company-managed or personally owned (BYOD). It was updated within the last 30 days.
At minimum: operating system, browser, productivity suite (Microsoft 365 or Google Workspace), email client, VPN, endpoint protection, and any remote access tools. Version numbers included.
All people, devices, and systems used for business operations are identified. Contractor devices and personal devices used for work email or file access are included. There are no devices you would discover during the assessment that are not already on the list.
Microsoft 365, Google Workspace, cloud storage, CRM, finance platforms, project management tools. Services where business data is processed or stored are in scope for CE even if they are not physically in your office.
Assessors cannot certify what they cannot verify. If you say "all 35 devices are compliant" but your asset register shows 31, the assessor will ask about the other four. If they turn up after submission with a gap, the application fails. Fix the register first.
Account hygiene is where most "yes" answers become "no" under scrutiny.
User access control is not just about having the right policies. It is about whether those policies are enforced and evidenced in practice across every account in the organisation.
Shared accounts make it impossible to attribute actions to individuals and complicate MFA enforcement. If shared accounts exist for a documented operational reason (a reception desk login, a service account), they must be documented and have restricted privileges.
Administrators use a standard account for routine work (email, documents, browsing) and a separate, named admin account only for administrative tasks. The admin account does not have a mailbox, is not used for general browsing, and is protected by MFA.
Access is granted on a defined schedule when someone joins, updated when their role changes, and fully revoked within a defined timeframe (ideally same day) when they leave. Evidence exists of the last three to five leaver events showing all systems were covered, not just the obvious ones.
Standard users cannot install software, change security settings, or access data outside their role. Privilege escalation follows a documented process. Access rights are reviewed periodically, not just at onboarding.
Available is not the same as enforced. Enforced on some accounts is not the same as enforced everywhere.
MFA is one of the most scrutinised areas in a Cyber Essentials assessment. The assessor is looking for evidence that MFA is enforced by policy, not self-reported by users as something they have enabled.
Not available, not recommended, not on by default for new accounts. Enforced. A user who has not set up MFA cannot log in. This is a conditional access policy setting, not a user choice. Check the policy in your Microsoft 365 or Google Workspace admin console and confirm it covers mobile app access too.
Remote access without MFA is the most common attack vector for SME breaches and a consistent Cyber Essentials failure point. If someone can reach your internal network or admin systems from outside the office, MFA must be on that path.
Admin MFA is non-negotiable. A single admin account without MFA is sufficient to fail this section. If an exception exists for a legacy system or service account that genuinely cannot support MFA, it must be documented with a compensating control and that documentation reviewed before submission.
Legacy authentication protocols bypass MFA entirely. If basic auth is enabled on Microsoft 365 mailboxes, an attacker with a password can access them without the second factor. Block legacy auth in conditional access before submission.
Many firms enable MFA via Microsoft Authenticator and believe it is fully enforced. If legacy authentication protocols are still enabled, those accounts can be accessed without MFA using a password alone. Check the Sign-in Logs in Entra ID for any successful logins using legacy authentication. Block it before you submit.
Patching requires a defined update window and evidence, not a best-effort intention.
CE requires a defined patch management process with a stated timeframe for applying security-critical updates. "We update when we get around to it" does not pass. A number does: 14 days for critical, 30 days for high.
Windows 10 (while still supported), Windows 11, current macOS, current iOS and Android. End-of-life operating systems cannot be included in the scope of a CE assessment. If a device runs Windows 10 21H2 or earlier, it must be updated or excluded with documented justification.
A written policy commits to a specific number of days for applying security-critical and high-severity updates (CVSS 7.0 or above). 14 days is the CE standard for internet-facing software. The policy reflects what actually happens, not an aspirational number.
Browser extensions and plugins are a common blind spot. Chrome, Edge, and Firefox plugins receive security updates independently of the browser. Office add-ins, PDF readers, and collaboration tools all count as in-scope software that must be patched within the stated window.
Reports or screenshots from an MDM or RMM tool, Windows Update for Business policy compliance reports, or Intune device compliance status showing OS version and last patch date for each device in scope.
Deployed everywhere, actively updating, and provable with evidence.
Endpoint protection must be present on every device in scope, configured to scan automatically, and kept up to date. Partial coverage or manual-only scanning does not meet the standard.
Microsoft Defender for Business, a reputable third-party EDR or AV solution, or the built-in OS protection (Windows Defender, macOS XProtect and Gatekeeper) configured and active. Not "most laptops" or "the office machines". Every device.
Automatic scheduled scans are active. Definitions are set to update automatically, and the management console shows all agents as healthy. Any devices showing as out of date or with protection disabled are flagged and resolved before submission.
Web filtering or safe browsing protections are enabled. Email scanning is active for attachments and links. In Microsoft 365, Defender for Office 365 Safe Attachments and Safe Links should be configured. These are in scope for the malware protection section of CE.
Default-deny, no exposed RDP, and no default passwords left in place.
This section covers both the network boundary and individual device configuration. The most common failures here are exposed RDP, default credentials on network devices, and host firewalls disabled on individual machines.
This is one of the most straightforward controls to evidence but also one of the most frequently found disabled "for convenience" or because an older application required it. Check all endpoints. Windows Firewall policy should be managed centrally via Group Policy or Intune.
Port 3389 open to the internet is one of the most actively scanned services on the internet. If remote access to Windows machines is needed: use a VPN with MFA as the entry point, allowlist specific IP addresses, enable Network Level Authentication, and ensure all accounts that can RDP have strong passwords and MFA.
Routers, wireless access points, network-attached storage, CCTV systems, smart devices, and printers all arrive with default credentials that are publicly documented. Any device on your network with an unchanged default password is an entry point. Include devices that arrived years ago.
File sharing services not needed for daily work, Bluetooth on devices that do not use it, features such as SMBv1 on Windows, Telnet and FTP on network devices, or unused cloud management interfaces. Every enabled service is an attack surface. Disable what is not needed.
What to collect before you submit
Inventory evidence
Device list export or spreadsheet dated within 30 days. Includes OS version and owner for each device. Cloud services listed separately.
MFA evidence
Policy screenshot showing MFA is enforced, not just enabled, for email, remote access, and admin accounts. Conditional access policy view from admin console.
Patch evidence
Device compliance report showing OS versions and last patch date for all devices in scope. MDM, Intune, or RMM export showing compliance status.
Endpoint protection evidence
Management console view showing all devices, protection status (healthy or not), last updated date, and real-time protection active.
Firewall evidence
Policy screenshot showing Windows Firewall or macOS firewall active on endpoints. Network firewall configuration if applicable. Port scan result showing no exposed RDP.
Access control evidence
Admin account list showing separation from standard accounts. Leaver log showing last 3 to 5 offboarding events with dates and systems covered.
The most efficient approach is to screenshot or export evidence at the point you apply each control, not at the end. Building the evidence pack retrospectively is where SMEs lose time. Keep a dated folder for each section and add to it as you work.
What to do with your results
Any "Not true" in sections 1, 2, or 3
Scope gaps, shared accounts, or missing MFA enforcement are the most common causes of failure. Fix these before anything else. They also affect your practical security posture more than the later sections.
Any "Mostly" anywhere in the checklist
A "Mostly" answer should be treated as a gap until it can be evidenced. Make it True before submission. A partial yes that cannot be documented under assessor scrutiny becomes a no.
All items True with evidence collected
If every item is genuinely True and you have the evidence to demonstrate it, you are in a strong position for assessment. Consider a review with a CE-experienced adviser before submitting to confirm there are no blind spots.