# Cyber Essentials in Practice: A Five-Control Implementation Checklist

A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.

Cyber Essentials-style frameworks exist because most breaches don't involve nation-state tradecraft, they involve basic gaps that a modest amount of structured effort closes. This guide breaks the five core control areas into concrete, checkable actions.

 
## 1. Firewalls and network boundary controls
  - Every internet-connected device sits behind a properly configured firewall[↗](/firewall), including a software firewall on individual laptops used outside the office.
 - Default administrative passwords on routers and firewalls are changed before deployment.
 - Only the network services genuinely needed are open to the internet; everything else is closed by default.
  
## 2. Secure configuration
  - Devices and software are configured to the most secure setting available, not left on vendor defaults.
 - Unnecessary user accounts are removed, and default or guessable passwords are changed everywhere, including on IoT devices and printers.
 - Auto-run features that launch software from removable media without user confirmation are disabled.
  
## 3. Access control[↗](/access-control)
  - User accounts are created only after a proper approval process, and are unique to each individual, no shared logins.
 - Administrative privileges are given only to the small number of people who genuinely need them, and only used for admin tasks (day-to-day work happens from a standard account).
 - Accounts are removed or disabled promptly when someone leaves or changes role.
  
## 4. Malware[↗](/malware) protection
  - Anti-malware software is installed, kept updated, and configured to scan files automatically on access and download.
 - Where anti-malware software isn't practical (some mobile platforms), application allow-listing or sandboxing is used instead.
  
## 5. Security update management (patch management[↗](/patch-management))
  - All software is licensed, supported, and removed once it reaches end-of-life.
 - Security updates classified as critical or high severity are applied within 14 days of release.
 - An accurate, current inventory of hardware and software exists, you cannot patch[↗](/patch) what you don't know you have, which is why asset management underpins every other control here.
  
## Building the assessment habit
 The controls above are not a one-time project; they're an operating discipline. A lightweight internal review, even a quarterly half-day session against this checklist, catches the configuration drift that naturally accumulates as staff, devices, and software change. Larger organizations often formalize this into a recurring self-assessment against a recognized framework, which also produces the evidence needed for cyber insurance[↗](/cyber-insurance) applications and client due-diligence questionnaires.

 
## Common gaps found in real assessments
  - Personal devices used for work email that were never enrolled in any management or patch-tracking system.
 - Cloud admin accounts without multi-factor authentication[↗](/authentication), because "it's just a settings panel."
 - Legacy software kept running because "the one person who understands it" retired without documenting a replacement plan.
 
## Frequently Asked Questions

### What are the 5 Cyber Essentials controls?
Firewalls and network boundary controls, secure configuration, access control, malware protection, and security update (patch) management.

### How often should this checklist be reviewed?
At minimum quarterly, a lightweight internal review catches configuration drift that naturally builds up as staff, devices, and software change.

## Related reading
 [Closing the Window: Patch and Configuration ManagementMost breaches exploit vulnerabilities that already had a fix available. Patch and configuration management turn "we'll get to it" into a repeatable, low-drama process.](/closing-the-window-patch-and-configuration-management) [Anatomy of a Cyber Attack: From Reconnaissance to RansomUnderstanding the typical stages of a cyber attack helps you recognize warning signs earlier, and understand why national cyber strategy focuses where it does.](/anatomy-of-a-cyber-attack-from-reconnaissance-to-ransom) [Penetration Testing and Security Assessments ExplainedWhat a penetration test actually involves, how it differs from a vulnerability scan, and how frameworks and certifications fit into a mature security program.](/penetration-testing-and-security-assessments-explained)