Preparing a UK Business for Cyber Essentials

Achieving Cyber Essentials certification in the UK is no longer an optional badge for a company footer. Over the last three years, it has evolved into a mandatory commercial gateway. If your business tenders for UK public sector contracts, bids on local council work, operates within enterprise supply chains, or applies for cyber insurance, you will be asked for your Cyber Essentials certificate number.

Operated by the National Cyber Security Centre (NCSC) and delivered by IASME, Cyber Essentials is designed to protect UK organisations against approximately 80% of common internet-based cyber attacks. Yet, dozens of small and medium businesses in Greater Manchester and across the UK fail their initial assessment. They fail not because their infrastructure is unfixable, but because common defaults in modern cloud tenants like Microsoft 365 violate NCSC specifications.

As an independent specialist, I regularly prepare UK businesses for their certification audits. Below is the exact technical blueprint I follow to ensure clients pass their verification first time.

The 5 Core Technical Controls: What Assessors Check

Cyber Essentials evaluates five distinct technical pillars. Every device, cloud service, and user account within your organisational scope must satisfy each pillar without exception.

1. Firewalls & Boundary Gateways

The first line of defence is ensuring all devices communicating with the internet pass through a properly configured boundary or host-based firewall.

• Office Hardware Firewalls: If your team works from a physical office, consumer-grade ISP routers (such as default BT or Virgin hubs) often have basic stateful firewalls, but lack deep packet inspection or segmented guest networks. Default administrative passwords must be changed immediately, and remote administrative interfaces must be disabled on the WAN port.
• Host Firewalls for Remote Staff: When staff work from home or in transit, the office boundary no longer protects them. You must enforce software firewalls (Windows Defender Firewall or macOS Packet Filter) via central policy (Microsoft Intune), preventing users from disabling them locally.
• Inbound Port Rules: All inbound rules permitting unsolicited connections must be justified, documented, and restricted to verified IP addresses. Legacy protocols such as RDP (port 3389) exposed directly to the public internet will result in an instant audit failure.

2. Secure Configuration: Eliminating Exploitable Defaults

Out of the box, computers, operating systems, and network gear are configured for maximum user convenience rather than defence. Cyber Essentials mandates baseline hardening:

• Default Credentials: Every default password on hardware routers, switches, access points, and printers must be replaced with strong, unique credentials stored in an encrypted password manager.
• Unnecessary Software Removal: Bloatware, pre-installed vendor utilities, trial software, and obsolete applications (such as legacy browsers or outdated Java runtimes) must be uninstalled across all laptops.
• Auto-Play & Auto-Run: Auto-run features on USB drives must be disabled via Group Policy or Intune device configuration profiles to prevent automated malware execution via physical media.
• Password Policy Alignment: Passwords must either be at least 12 characters with multi-factor authentication enforced, or at least 8 characters with rate-limiting brute-force protection and automatic compromise checks against known leaked password databases.

3. Access Control & The Principle of Least Privilege

Misconfigured user privileges and weak authentication represent the single largest cause of assessment failure. Under NCSC standards:

• Universal Multi-Factor Authentication (MFA): MFA is non-negotiable across every cloud service that connects to your business data (Microsoft 365, Google Workspace, AWS, accounting software like Xero). This applies to every user, every contractor, every shared administrative mailbox, and without exception. Legacy basic authentication must be completely disabled in Microsoft Entra ID.
• Separation of Admin Accounts: No user should perform day-to-day work (email, web browsing, document drafting) using an account with administrative privileges. I set up dedicated secondary admin accounts (e.g., admin.jane@company.co.uk) specifically for infrastructure management, keeping daily accounts unprivileged.
• Account Review & Offboarding: Accounts belonging to former staff, contractors, or inactive projects must be promptly de-provisioned, their active sessions revoked, and mailbox access delegated or archived.

"Security is not a product, but an operational standard. Enforcing universal phishing-resistant MFA across your entire team closes over 90% of identity-based intrusion vectors."

4. Malware Protection: Modern Endpoint Defence

Cyber Essentials requires active malware protection across all computers, tablets, and smartphones that connect to company resources. In 2026, relying on free legacy antivirus is insufficient:

• Centralised Management: Antivirus definitions must update automatically every day without requiring end-user interaction. Through Microsoft Defender for Business (included with Microsoft 365 Business Premium), endpoint health is monitored in real-time from a single security dashboard.
• Application Whitelisting / Sandboxing: Only approved applications should be allowed to execute. Microsoft Defender SmartScreen must be enforced to block untrusted web downloads.
• Device Isolation: If a laptop detects anomalous ransomware behaviour, it must possess the automated capability to isolate itself from the local network and cloud sync while alerting IT administrators.

5. Security Update & Patch Management: The 14-Day Rule

This is the most strictly audited technical rule in Cyber Essentials: all operating systems, browsers, and installed third-party software must be updated within 14 calendar days of a high-risk or critical security patch being released by the vendor.

• Operating Systems: All Windows machines must be running supported versions (Windows 11 or currently supported Windows 10 enterprise builds). Unsupported systems (Windows 7, 8, or unsupported macOS versions) will cause immediate failure.
• Third-Party Applications: It is not enough to update Windows; third-party software like Adobe Acrobat, Chrome, Slack, and Zoom must also receive patches within 14 days. I automate this via Microsoft Intune update rings and winget repository packaging.
• Firmware: Office routers and wireless access points must have vendor firmware support and be updated within the same 14-day window upon vulnerability disclosure.

Self-Assessment vs Cyber Essentials Plus

There are two levels of certification:

1. Cyber Essentials (Verified Self-Assessment): You complete a rigorous technical questionnaire covering all 5 controls, signed off by a company director and verified by an independent IASME certification body.
2. Cyber Essentials Plus: The gold standard. An independent assessor conducts direct hands-on technical vulnerability scans on your workstations, tests email gateway filters with simulated malicious payloads, and audits firewall ports remotely.

If you have properly configured your Microsoft 365 tenant, enrolled your devices into Microsoft Intune, and enforced baseline security policies, passing either assessment becomes a predictable, stress-free milestone rather than a commercial headache.