Cyber Essentials Readiness Checklist

Ready for certification

0 / 25

Items confirmed

Tick each item below as you confirm it is in place for your organisation.

Control 1 · Section A4 FIREWALLS

Boundary firewalls must protect every device in scope from the internet. Question numbers below match the official IASME Cyber Essentials (Danzell) self-assessment, so you can map each check straight onto your application.

A4.1Firewalls are in place at the boundaries between your internal networks, laptops, desktops, servers and the internetA4.1.1: where there is no boundary firewall (e.g. home or mobile working), a software firewall must be enabled on each device

A4.2All default passwords on your boundary firewall devices and routers have been changedFactory-default credentials must be replaced before the device is used

A4.5You have a process to manage your firewall - including changing the password promptly if you suspect it has been compromisedA4.3–A4.4: firewall access must be protected by MFA or a password of at least 8 characters, changed on suspected compromise

A4.6Your firewall rules have been reviewed within the last 12 months, and rules with no business need have been removedA4.8: any allowed inbound connection must have a documented business case and approval

A4.7Your firewall blocks unauthenticated inbound connections by defaultDeny by default, permit by exception - A4.9: firewall admin interfaces must not be openly accessible from the internet

Control 2 · Section A5 SECURE CONFIGURATION

Computers, devices and cloud services must be configured to reduce inherent vulnerabilities - unnecessary software, accounts and features removed or disabled.

A5.1Software and services you do not use have been removed or disabled on all laptops, desktops, servers, tablets, mobile phones and cloud servicesEvery installed application or enabled service is potential attack surface

A5.3Default passwords have been changed on all user and administrator accounts across your devicesA5.2: devices and cloud services must only contain necessary accounts that are regularly used - remove or disable the rest

A5.7External services without MFA are protected from brute-force attacks - by throttling attempts or locking accounts after no more than 10 failed loginsApplies where you run or host services accessible across the internet (A5.4–A5.6)

A5.8Features that automatically execute downloaded or imported files without user authorisation (auto-run / auto-play) are disabledIt is acceptable to prompt the user for a choice instead

A5.9A locking mechanism (biometrics, password or PIN) is set on all devices that require a user present to operate themA5.10: the unlock method must be declared - a PIN must be at least 6 characters where used

Control 3 · Section A6 SECURITY UPDATE MANAGEMENT

All software in scope must be supported and patched. High-risk and critical updates must be applied within 14 days - A6.4 and A6.5 are automatic-failure questions under Danzell.

A6.1All operating systems on your devices are supported by a vendor that produces regular security updates and vulnerability fixesIncludes firewall and router firmware where in scope

A6.2All software on your devices is supported by a supplier that produces regular vulnerability fixesA6.2.1–A6.2.4: you will need to list your browsers, malware protection, email clients and office applications with versions - A6.3: no unlicensed or unsupported software

A6.4All high-risk or critical security updates and vulnerability fixes for operating systems and router/firewall firmware are installed within 14 days of release Auto-FailAnswering no to A6.4 is an automatic failure under Danzell - auto-update alone may not cover all firmware

A6.5All high-risk or critical security updates and vulnerability fixes for applications - including any associated files and extensions - are installed within 14 days of release Auto-FailAnswering no to A6.5 is an automatic failure - this includes browsers, plugins, Office suites and third-party apps

A6.6Software that is no longer supported or no longer receives security fixes has been removed from your devicesA6.7: where there is a business need to keep unsupported software, the devices must be moved out of scope with technical segregation

Control 4 · Section A7 USER ACCESS CONTROL

Accounts must be unique, approved, and given only the access each person needs. MFA on cloud services is an automatic-failure question under Danzell.

A7.2All user and administrative accounts are accessed by entering unique credentials - no shared logins are in useA7.1: accounts are only created after a documented approval process

A7.3Accounts for staff who have left your organisation are deleted or disabled promptlyYou should be able to describe the leaver process you follow

A7.4Staff only have the access privileges they need to do their current job - least privilege is applied and reviewed on role changesStandard users should not have access to data or systems they do not use

A7.6Separate accounts are used for administrative tasks - admin accounts are not used for everyday activities such as browsing the web or accessing emailA7.7–A7.9: admin use must be prevented for daily tasks, formally tracked, and reviewed regularly

A7.17MFA has been applied to all users of all your cloud services - including Microsoft 365, Google Workspace and any SaaS tools Auto-FailA7.14–A7.16: where a cloud service offers MFA it must be enabled for administrators and all users - failing this is an automatic fail under Danzell

Control 5 · Section A8 MALWARE PROTECTION

Every device must be protected by anti-malware software (Option A) and/or an approved application allow list (Option B). Tick the items for the option(s) you use.

A8.1All desktop computers, laptops, tablets and mobile phones are protected from malware - by anti-malware software (Option A) and/or an app store with application allow-listing (Option B)Built-in solutions such as Microsoft Defender are acceptable for Option A

A8.2Anti-malware software updates in line with vendor guidance and prevents malware from running on detectionApplies where Option A is used - manual updating is not reliable

A8.3Anti-malware software scans web pages you visit and warns about access to malicious websitesApplies where Option A is used - this can be provided by the AV product or browser protection it manages

A8.4Users are restricted from installing unsigned applicationsApplies where Option B (app store / application signing) is used

A8.5Users can only install applications that have been approved by your organisation, maintained as an approved listApplies where Option B is used - the approved list should be documented and kept current

// What Next?

READY TO GET CERTIFIED?

Our UK-based team will review your environment, identify any remaining gaps, and guide you through every step of certification. View pricing →

Get Certified →Build Your Quote →

Also pursuing CE Plus? CE Plus adds an independent technical audit on top of CE basic. Use the dedicated checklist to confirm your environment is ready for the audit across all seven tested control areas. Open the CE Plus readiness checklist →

This checklist is based on the Cyber Essentials v3.3 (Danzell) requirements effective April 2026. It is provided as a self-assessment guide only - formal certification requires assessment by an IASME Approved Certification Body. For a formal gap analysis, contact our team.

CYBER ESSENTIALSREADINESS CHECKLIST