The five Cyber Essentials controls, using the same check where Microsoft 365 can answer and a question where it cannot.
13 checks
Firewalls
A firewall sits between the organisation and the internet
Cyber Essentials requires a boundary firewall or router so the office network is not open to the internet.
Firewalls
A firewall is switched on for each computer
Cyber Essentials requires a host firewall on devices, including those that leave the office.
Secure configuration
Unused accounts are removed or switched off
Cyber Essentials says accounts that are no longer needed must not stay active.
Secure configuration
Default passwords have been changed
Cyber Essentials does not allow unchanged default passwords on devices, software or network equipment.
Secure configuration
Auto-run is off for USB drives and similar media
Cyber Essentials requires auto-run to be disabled so a plugged-in drive cannot start a program on its own.
Security updates
Computers and software are still supported
Cyber Essentials only allows software that the vendor still provides security updates for.
Security updates
High-risk updates are applied within 14 days
Cyber Essentials requires updates that fix critical or high-risk flaws to be installed within 14 days.
User access
Each person has their own account
Cyber Essentials requires a unique account per person. Shared logins are not accepted.
User access
Multi-factor authentication is on for users
Cyber Essentials requires a second factor for cloud services.
User access
Administrator accounts are separate from everyday accounts
Cyber Essentials requires admin work to be done from an account that is not used for email and everyday work.
User access
Only an administrator can approve new software
Cyber Essentials requires an admin to approve applications before people install or connect them.
Malware protection
Anti-malware is on for every device
Cyber Essentials requires malware protection on devices that access the organisation's data.
Malware protection
Malware protection updates itself
Cyber Essentials requires malware signatures and the protection software itself to stay up to date.