Cyber Essentials

Requirements and controls

• CE-SCOPE Scope of the assessment

  • CE-SCOPE-1 Defined certification boundary

    Decide whether the whole IT estate or a separately managed and segregated part of it is certified, record the business unit, network boundary and locations involved, justify anything left out, and agree the scope with the certification body before assessment.

    • ISMS Scope Document
    • Inventory of Infrastructure Assets
    • Inventory of Endpoint Assets

  • CE-SCOPE-2 Internet-connected devices and software included

    Cover every device and piece of software that can receive connections from the internet, open connections to it, or control traffic between the two; a scope without end-user devices is never acceptable.

    • Inventory of Endpoint Assets
    • Inventory of Infrastructure Assets
    • Asset Inventory Updates

  • CE-SCOPE-3 Cloud services included

    Bring every cloud service that stores organisational data or runs organisational services into scope, and where the provider operates one of the controls, have that commitment in the contract or in documents it references.

    • Shared Responsibility Model
    • Subservice Organization Evaluation
    • Vendor Management Policy & Procedure
    • Inventory of Infrastructure Assets

  • CE-SCOPE-4 Personal and remote working devices

    Treat staff-owned devices that reach organisational data or services, every device used for home or remote work, and any router the organisation supplies as in scope; devices used only for native calls, texts or authenticator apps are excluded.

    • Inventory of Endpoint Assets
    • Endpoint Security Policy
    • Rules of Behavior

  • CE-SCOPE-5 Wireless devices

    Include access points and other wireless devices that can talk to other devices across the internet; equipment that can only be attacked within radio range, or that is part of a home ISP router, stays out.

    • Inventory of Infrastructure Assets
    • Network Security Policy & Procedure

  • CE-SCOPE-6 Accounts used by third parties

    Keep every account the organisation owns in scope even when a supplier, contractor or managed service provider uses it, and be able to show that outsourced administration meets the five controls.

    • Subservice Organization Evaluation
    • Identity Validation
    • Third-Party Criticality Assessments

  • CE-SCOPE-7 Devices lent to or owned by third parties

    Include organisation-owned end-user devices lent to others, and take your own steps to confirm that out-of-scope devices belonging to contractors, providers or customers are set up securely before they touch organisational services.

    • Inventory of Endpoint Assets
    • Endpoint Security Policy

  • CE-SCOPE-8 Web applications and in-house development

    Off-the-shelf web applications offered publicly are in scope by default while bespoke components are not; reduce application flaws through sound development and testing practice.

    • Change Management Policy & Procedure
    • Approval of Changes

• CE-FW Firewalls

  • CE-FW-1 Firewall protection for every device

    Put every in-scope device behind a correctly configured boundary firewall or, where the organisation does not control the network, a software firewall on the device itself; for cloud services, use the equivalent traffic policies.

    • Host-Based Firewalls
    • External System Connections
    • Limit Network Connections

  • CE-FW-2 No default firewall administrator passwords

    Replace the default administrative password on each firewall or router with a strong, unique one, or turn off remote administration entirely.

    • Secure Configuration Baselines
    • Password Management Guidelines

  • CE-FW-3 Firewall management interface kept off the internet

    Keep the firewall's administrative interface unreachable from the internet unless a documented business need exists, and in that case protect it with MFA or with an IP allow list plus managed passwords.

    • External System Connections
    • Multi-Factor Authentication
    • Network Security Policy & Procedure

  • CE-FW-4 Unauthenticated inbound traffic blocked by default

    Configure firewalls to refuse unauthenticated inbound connections unless a rule explicitly allows them.

    • External System Connections
    • Limit Network Connections
    • Host-Based Firewalls

  • CE-FW-5 Approved and documented inbound rules

    Have an authorised person approve every inbound firewall rule and record the business reason for it.

    • External System Connections
    • Network Security Policy & Procedure

  • CE-FW-6 Unneeded firewall rules removed

    Take out or disable firewall rules as soon as they are no longer required.

    • External System Connections
    • Network Security Policy & Procedure

  • CE-FW-7 Software firewall on untrusted networks

    Run a software firewall on any device that connects to networks the organisation does not trust, such as public wifi.

    • Host-Based Firewalls
    • Endpoint Security Policy

• CE-SC Secure configuration

  • CE-SC-1 Unneeded accounts removed

    Regularly remove or disable user accounts nobody needs, such as guest accounts and administrator accounts that will not be used.

    • Secure Configuration Baselines
    • User Access Reviews
    • Production Database Access Restriction

  • CE-SC-2 Default and guessable passwords changed

    Replace any default or easily guessed account password with one that meets the password rules.

    • Secure Configuration Baselines
    • Password Management Guidelines

  • CE-SC-3 Unneeded software removed

    Remove or disable applications, system utilities and network services that serve no purpose on the device.

    • Secure Configuration Baselines
    • Software Inventory & Authorization

  • CE-SC-4 Auto-run turned off

    Disable any auto-run feature that would let files execute without the user agreeing, such as when they are downloaded.

    • Secure Configuration Baselines
    • Endpoint Security Policy

  • CE-SC-5 Sign-in before access to data and services

    Make sure users are authenticated before they can reach organisational data or services.

    • Access Control Policy & Procedure
    • Multi-Factor Authentication
    • Password Management Guidelines

  • CE-SC-6 Credential required to unlock devices

    Where someone must be physically present to use a device, require a biometric, password or PIN before it unlocks.

    • Session Lock
    • Endpoint Security Policy

  • CE-SC-7 Brute-force protection for device unlock

    Protect the unlock method against guessing by allowing no more than 10 attempts in 5 minutes or by locking after no more than 10 failures, keeping the vendor default where neither can be configured.

    • Endpoint Security Policy
    • Session Lock

  • CE-SC-8 Unlock credential length

    Enforce at least 6 characters for a password or PIN used only to unlock a device, and the full password requirements when the same credential also signs the user in to services.

    • Endpoint Security Policy
    • Password Management Guidelines

• CE-SUM Security update management

  • CE-SUM-1 Licensed and supported software

    Run only software the organisation has the right to use and that a vendor still supports with security fixes and a stated end-of-support date.

    • Software Inventory & Authorization
    • Timely Security Updates

  • CE-SUM-2 Unsupported software removed or isolated

    Take software off devices once it falls out of support, or move it into a separate subset that has no internet traffic in or out.

    • Software Inventory & Authorization

  • CE-SUM-3 Automatic updates

    Turn on automatic updates wherever the software offers them.

    • Timely Security Updates
    • Endpoint Security Validation

  • CE-SUM-4 High-risk updates within 14 days

    Install an update within 14 days of release when it fixes vulnerabilities the vendor rates critical or high, that score 7 or more in CVSS v3, or whose severity the vendor does not state.

    • Timely Security Updates
    • Vulnerability Remediation Process
    • Endpoint Security Validation

• CE-UAC User access control

  • CE-UAC-1 Account creation and approval process

    Follow a defined process to create user accounts and approve them before use, including accounts used by support providers.

    • Access Control Policy & Procedure
    • Identity Validation

  • CE-UAC-2 Unique credentials for every user

    Authenticate each user with credentials of their own before giving access to applications or devices.

    • Identity Validation
    • Password Management Guidelines
    • Multi-Factor Authentication

  • CE-UAC-3 Accounts removed when no longer needed

    Remove or disable accounts once they stop being needed, such as when someone leaves or after a set period without use.

    • Termination of Employment
    • Production Database Access Restriction
    • User Access Reviews

  • CE-UAC-4 MFA wherever offered and always for cloud services

    Turn on multi-factor authentication wherever a service offers it, and always for cloud services.

    • Multi-Factor Authentication
    • Production Database Access Restriction

  • CE-UAC-5 Separate administrator accounts

    Use dedicated accounts for administration only, never for email, web browsing or other everyday tasks that would expose those privileges.

    • Dedicated Administrator Accounts
    • Production Database Access Restriction

  • CE-UAC-6 Privileges removed when no longer needed

    Take away special access privileges when they stop being needed, for example after a change of role.

    • User Privilege Reviews
    • Production System Access Review

  • CE-UAC-7 MFA for administrators and internet-facing accounts

    Prioritise multi-factor authentication for administrator accounts and accounts reachable from the internet, with any password factor at least 8 characters long and no upper length limit.

    • Multi-Factor Authentication
    • Password Management Guidelines

  • CE-UAC-8 Password guessing protection

    Defend password sign-ins against guessing with MFA, with throttling to no more than 10 attempts in 5 minutes, or with lockout after no more than 10 failures.

    • Multi-Factor Authentication
    • Production Database Access Restriction
    • Password Management Guidelines

  • CE-UAC-9 Technical password quality controls

    Enforce password quality through MFA, a minimum length of 12 characters, or a minimum of 8 characters combined with automatic blocking of common passwords, never capping the maximum length.

    • Password Management Guidelines
    • Production Database Access Restriction
    • Multi-Factor Authentication

  • CE-UAC-10 Helping users pick unique passwords

    Help staff choose strong, unique work passwords through guidance such as three random words and a password manager or other secure storage, without forcing regular expiry or complexity rules.

    • Password Management Guidelines
    • Security & Privacy Awareness
    • Periodic Security & Privacy Training

  • CE-UAC-11 Password change after suspected compromise

    Have an established way to change a password quickly when it, or the account, is known or suspected to be compromised.

    • Password Management Guidelines
    • Incident Management Policy & Procedure

• CE-MP Malware protection

  • CE-MP-1 Active malware protection on every device

    Keep at least one malware protection mechanism switched on, current and configured as required on every in-scope device.

    • Malware Protection

  • CE-MP-2 Anti-malware software configuration

    Where anti-malware software is the chosen option, set it to update as the vendor recommends, stop malware and malicious code from running, and block connections to malicious websites.

    • Malware Protection
    • Email & Web Threat Protection

  • CE-MP-3 Application allow listing

    Where allow listing is the chosen option, approve applications before they are deployed, keep the approved list current and rely on code signing so users cannot install unsigned or invalidly signed software.

    • Software Inventory & Authorization