# Cyber Essentials Certification Guide
*Playbook · Complying · Level: Beginner · Typical timescale: 2 to 4 weeks · Last reviewed: July 2026 · https://cyberdataservices.uk/playbooks/cyber-essentials-certification-guide*

> A practical route to UK Cyber Essentials certification: the five controls, the evidence to prepare, and how to pass first time.

What you need in place to pass the UK Cyber Essentials assessment, covering the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

## Prerequisites
- A list of everything in scope: laptops, desktops, mobiles, servers, and any personal devices used for work.
- Every cloud service you use to store or process organisational data, such as Microsoft 365 or Google Workspace.
- Administrative access to your firewalls, devices and cloud consoles so settings can be checked and changed.
- One named person to own the assessment and gather evidence from across the business.

## Step-by-step

### 1. Set your scope
By default Cyber Essentials covers the whole organisation. You can certify a clearly separated part of the business instead, but only if a firewall or VLAN divides it from the rest. Decide this first, because scope shapes every answer that follows. Include all internet facing devices, all end user devices, and all cloud services that hold your data.

Tip: Home workers are in scope. Any device used to reach organisational data from home counts, even when the broadband router belongs to the employee.

### 2. Firewalls and internet gateways
Put a correctly configured firewall between every device and the internet. That means the boundary firewall at the office and the software firewall on each laptop that leaves it. Change default administrative passwords, block inbound connections you have not approved, and remove rules you no longer use.

### 3. Secure configuration
Vendor defaults are built for convenience, not security. Remove software and accounts you do not need, disable features that are switched on but unused, and require a PIN or password to unlock each device. The aim is a smaller attack surface on every device and service in scope.

### 4. Security update management
Everything in scope must still be supported by its vendor and receiving security updates. Turn on automatic updates where you can, and apply critical and high risk patches within 14 days of release. Retire any software or operating system that has reached end of life, because unsupported kit fails the assessment on its own.

Tip: The 14 day rule applies to updates the vendor marks critical or high risk, or that fix a vulnerability scoring 7 or above on CVSS v3.

### 5. User access control
Give people only the access their role needs, and keep separate administrator accounts that are used for admin work alone. Remove accounts quickly when someone leaves or changes job, and keep a record of who holds admin rights. Multi factor authentication is required on all cloud services and on every administrator account.

### 6. Malware protection
Protect every device using one of the accepted methods: anti malware software, application allow listing, or sandboxing. For most small organisations the protection built into a modern operating system is enough, provided it is switched on, kept current, and scanning files as they are opened.

### 7. Complete the assessment and plan for Plus
Work through the self assessment question set honestly and submit it through a certification body. If a supplier or contract asks for a hands on audit, Cyber Essentials Plus tests the same five controls with an assessor, usually within three months of your basic certificate. Treat the questionnaire as a yearly health check, not a one off.

---
Source: https://cyberdataservices.uk · Cyber Data Services (trading name of Tom Sykes Ltd, company no. 06947397), part of the Stiperstone Group.
General information only, not specific security or legal advice. For guidance on your own systems, contact info@cyberdata.services or 01952 972 404.