Cyber Essentials in Practice: A Five-Control Implementation Checklist
A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.
What are the 5 Cyber Essentials controls?
Firewalls and network boundary controls, secure configuration, access control, malware protection, and security update (patch) management.
Cyber Essentials-style frameworks exist because most breaches don't involve nation-state tradecraft, they involve basic gaps that a modest amount of structured effort closes. This guide breaks the five core control areas into concrete, checkable actions.
1. Firewalls and network boundary controls
- Every internet-connected device sits behind a properly configured firewall↗, including a software firewall on individual laptops used outside the office.
- Default administrative passwords on routers and firewalls are changed before deployment.
- Only the network services genuinely needed are open to the internet; everything else is closed by default.
2. Secure configuration
- Devices and software are configured to the most secure setting available, not left on vendor defaults.
- Unnecessary user accounts are removed, and default or guessable passwords are changed everywhere, including on IoT devices and printers.
- Auto-run features that launch software from removable media without user confirmation are disabled.
3. Access control↗
- User accounts are created only after a proper approval process, and are unique to each individual, no shared logins.
- Administrative privileges are given only to the small number of people who genuinely need them, and only used for admin tasks (day-to-day work happens from a standard account).
- Accounts are removed or disabled promptly when someone leaves or changes role.
4. Malware↗ protection
- Anti-malware software is installed, kept updated, and configured to scan files automatically on access and download.
- Where anti-malware software isn't practical (some mobile platforms), application allow-listing or sandboxing is used instead.
5. Security update management (patch management↗)
- All software is licensed, supported, and removed once it reaches end-of-life.
- Security updates classified as critical or high severity are applied within 14 days of release.
- An accurate, current inventory of hardware and software exists, you cannot patch↗ what you don't know you have, which is why asset management underpins every other control here.
Building the assessment habit
The controls above are not a one-time project; they're an operating discipline. A lightweight internal review, even a quarterly half-day session against this checklist, catches the configuration drift that naturally accumulates as staff, devices, and software change. Larger organizations often formalize this into a recurring self-assessment against a recognized framework, which also produces the evidence needed for cyber insurance↗ applications and client due-diligence questionnaires.
Common gaps found in real assessments
- Personal devices used for work email that were never enrolled in any management or patch-tracking system.
- Cloud admin accounts without multi-factor authentication↗, because "it's just a settings panel."
- Legacy software kept running because "the one person who understands it" retired without documenting a replacement plan.
Frequently Asked Questions
What are the 5 Cyber Essentials controls?
Firewalls and network boundary controls, secure configuration, access control, malware protection, and security update (patch) management.
How often should this checklist be reviewed?
At minimum quarterly, a lightweight internal review catches configuration drift that naturally builds up as staff, devices, and software change.
Related reading
