Five controls. One objective: reduce your exposure to the most common cyber attacks.
Cyber Essentials is built around five fundamental technical controls:
- Firewalls
- Secure Configuration
- Security Update Management
- User Access Control
- Malware Protection
The principles are deliberately straightforward. The challenge is making sure they are applied consistently across every device, application and service within your Cyber Essentials scope, so you’re going to need help and SX7 is ready to go!
This guide explains what each control requires, the common weaknesses to look for and the practical steps you can take to prepare for certification.
SecureX7 helps turn those requirements into measurable technical checks — discovering your assets, identifying configuration and vulnerability gaps, prioritising remediation and helping you verify that improvements have actually been made.
Understand the five controls. Find the gaps. Fix what matters.
Cyber Essentials Firewall Requirements
Control the connections between your devices and the outside world
Cyber Essentials requires appropriate firewall protection between devices and untrusted networks such as the internet. This may be provided by a network firewall, router or the software firewall built into individual devices.
The principle is straightforward: block unnecessary inbound connections, control administrative access and ensure firewall configurations cannot be changed by users who do not have permission to do so.
The challenge is consistency. A firewall being installed does not necessarily mean it is enabled, correctly configured or operating consistently across every endpoint.
Cyber Essentials Secure Configuration
Secure by design, not simply by default
Cyber Essentials requires devices and software to be configured securely. Unnecessary accounts, applications and services should be removed or disabled, insecure default settings changed and security features configured appropriately.
The difficulty is scale. A Windows PC alone can contain hundreds of configurable security settings, applications and services. Multiply that across an organisation and manually checking every device against an approved baseline quickly becomes impractical.
Cyber Essentials Security Update Management
Finding a vulnerability is only useful if you know what to do next
Cyber Essentials requires in-scope software to be licensed and supported, with applicable high-risk or critical security fixes applied within 14 days of release.
That means understanding much more than whether Windows Update has run. Organisations need visibility of operating systems, applications and other software across their environment, whether those products remain supported and which vulnerabilities require action.
Cyber Essentials User Access Control
Give people the access they need — and no more
Cyber Essentials requires organisations to control access to systems and data, manage user accounts appropriately and restrict administrative privileges.
Users should normally operate with standard accounts. Administrative access should only be provided where necessary and used for tasks that genuinely require elevated privileges. Appropriate authentication controls, including MFA where required, provide additional protection.
The challenge is that access changes over time. Accounts are created, privileges are granted and temporary exceptions have a habit of becoming permanent.
Cyber Essentials Malware Protection
Protection needs to be present, active and correctly configured
Cyber Essentials requires organisations to protect devices against malicious software. Depending on the device and environment, this can involve anti-malware software, application allowlisting or application sandboxing.
For many Windows environments, Microsoft Defender or another endpoint security product provides the underlying protection. But having security software installed is not the same as knowing that protection is enabled and correctly configured across every device.
A single overlooked or incorrectly configured endpoint can create unnecessary exposure.