Cyber Essentials checklist for 2026 (v3.3)

This is a working checklist for a Cyber Essentials self-assessment under version 3.3 of the requirements, the version every basic assessment uses from late October 2026. Each item comes from the NCSC's Requirements for IT Infrastructure v3.3. Work through it before you open the question set, and the questions become a matter of writing down what you already did.

If you want the background first, the Cyber Essentials overview explains the five controls and the Danzell changes post covers what moved in 2026.

Before the controls: scope

Get scope right first, because every item below applies to everything inside it.

• List every legal entity in scope, with its address and company number.
• List every cloud service the organisation uses, including free ones and ones bundled with something else. Cloud services cannot be excluded.
• List the devices in scope: servers, desktops, laptops, tablets, phones, firewalls and routers, including staff-owned devices that reach organisational data or services. A phone used only for calls, texts or an MFA app is out of scope.
• If you exclude part of the network, write down why and how it is separated from the systems in scope.
• Write the scope description knowing it will appear on your public certificate.

Firewalls

• Every device in scope sits behind a correctly configured firewall, or a network device with firewall functionality.
• Default administrative passwords on every firewall and router are changed to a strong, unique password, or remote administration is switched off.
• The firewall's admin interface is not reachable from the internet. If it has to be, there is a documented business need and it is protected by MFA or by an IP allow list combined with a well-managed password.
• Unauthenticated inbound connections are blocked by default.
• Every inbound rule is approved by an authorised person and documented with its business need.
• Rules that are no longer needed are removed or disabled.
• Devices used on untrusted networks, such as public wifi, run a software firewall. Most laptop and desktop operating systems include one; turn it on.

The second and fifth items are where external exposure shows up. Our post on ports that should never face the internet lists the services that most often turn a firewall question into a failure.

Secure configuration

• Unnecessary user accounts are removed or disabled, including guest accounts and admin accounts nobody uses.
• Default or guessable passwords are changed everywhere.
• Unnecessary software is removed or disabled, including applications, system utilities and network services.
• Auto-run is disabled for anything that would execute a file without the user's say-so.
• Users authenticate before they reach organisational data or services.
• Devices that need someone physically present to unlock them use a biometric, password or PIN.
• That unlock method is protected against guessing: either throttling (no more than 10 guesses in 5 minutes) or locking after no more than 10 failed attempts. Where the vendor gives no setting, its default is accepted.
• An unlock-only PIN or password is at least 6 characters. If the same credential also signs the user in to services, the full password rules under user access control apply instead.

Security update management

• All software in scope is licensed and supported by its vendor.
• Unsupported software is removed, or moved into a separate part of the network with no traffic to or from the internet.
• Automatic updates are turned on wherever possible.
• Updates are installed within 14 days of release when the vendor calls the fix critical or high risk, when it fixes a vulnerability with a CVSS v3 base score of 7 or above, or when the vendor gives no severity detail.
• If one update bundles several fixes and any of them is critical or high, the whole update is on the 14-day clock.

Under v3.3, missing the 14-day rule for operating systems and firmware (A6.4) or for applications (A6.5) is an automatic fail of the whole assessment. Unsupported software is the item most often found late; we cover why in end-of-life software fails Cyber Essentials.

User access control

• There is a process to create and approve user accounts, including accounts used by third parties such as support providers.
• Every user signs in with their own unique credentials.
• Accounts are removed or disabled when no longer needed, such as when someone leaves or after a set period of inactivity.
• MFA is on wherever it is available, and always for cloud services. Missing it on a cloud service is an automatic fail under v3.3.
• Admin accounts are separate and used only for admin work, never for email or web browsing.
• Special access privileges are removed when no longer needed, for example on a change of role.

Passwords, where they are used:

• Guessing is limited by at least one of: MFA, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts.
• Password quality is controlled by one of: MFA, a minimum of 12 characters, or a minimum of 8 characters plus automatic blocking of common passwords. None of these may set a maximum length.
• With MFA, the password part is at least 8 characters.
• Staff are not forced to change passwords on a schedule, and not forced to meet complexity rules. The requirements say to avoid both.
• Staff have somewhere safe to keep passwords, such as a password manager.
• There is a known process for changing a password quickly when an account may be compromised.

SMS codes count as MFA, though the requirements recommend another method where one is workable.

Malware protection

• Every device in scope has malware protection active, using at least one of the two approved options.
• With anti-malware software: it updates in line with the vendor's advice, stops malware and malicious code from running, and blocks connections to malicious websites.
• With application allow-listing: only approved, code-signed applications can run, each one is approved before it is deployed, the approved list is kept current, and users cannot install unsigned software.

If you are going for Cyber Essentials Plus

• The assessor scans every internet-facing service in scope. Any service with a vulnerability scoring 7.0 or more fails, with no 14-day allowance. The CE Plus scan post walks through the rest of that test.
• A sample of devices gets an authenticated scan, and there a 7.0+ issue fails once its fix has been out for more than 14 days.
• Your self-assessment answers are locked before testing starts.

What CyberSpec checks for you

An outside scan can only help with the items that are visible from the internet: which services answer, whether their software is known to be vulnerable or out of support, and how long each problem has been open. Continuous scanning covers those for the assets you verify you own. It never tries passwords, cannot see your cloud MFA settings, and cannot look inside your network, so most of this list stays with you. For a quick first look, the free website security check reads your TLS, certificate and header setup without a port scan.

The checklist is the easy part to copy. The hard part is that half of it can drift between assessments, so the question is when you next check it, not whether you checked it once.

Source: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026. Where this list and that document disagree, the document is right.