CYBER ESSENTIALS
Cyber Essentials Readiness Checklist
Before you start your Cyber Essentials assessment, make sure you're ready.
Cyber Essentials Readiness Checklist
Cyber Essentials is designed to be straightforward, but many organisations discover gaps in their security controls only after they have started completing the assessment.
A little preparation can make the process considerably easier.
The key is to understand what is in scope, what needs protecting and whether the required technical controls are actually in place before submitting your answers.
This checklist will help you identify potential gaps before they become assessment problems.
Know your environment. Check your controls. Fix the gaps. Gather your evidence.
Scope & Inventory Checks
Start by understanding what's in scope
One of the most important parts of preparing for Cyber Essentials is establishing which devices, systems, services and users form part of the assessment.
You should have a clear picture of your:
Devices
Desktop computers, laptops, mobile devices and other end-user equipment.
Servers
Physical, virtual and cloud-hosted servers.
Operating systems
Including Windows, macOS, Linux, Android and iOS.
Applications and software
Particularly software that receives data from the internet.
Cloud services
Including email, file storage, collaboration tools and business applications.
Network equipment
Routers, firewalls and other devices controlling access to your network.
Users and administrators
Including privileged accounts and third-party access where applicable.
Check your software inventory
Knowing that you have 50 laptops isn't necessarily enough.
You also need visibility into what is running on them.
Look for unsupported operating systems, obsolete applications, forgotten software and devices that may no longer meet your organisation's security standards.
If you don't know an asset exists, it's very difficult to demonstrate that it is secure.
Five Controls Checklist
Cyber Essentials is built around five core technical controls.
1. Firewalls
Check that devices are protected from unauthorised access from the internet.
Review firewall configurations, remove unnecessary rules and ensure administrative interfaces aren't unnecessarily exposed.
Ask: Is anything accessible from the internet that doesn't genuinely need to be?
2. Secure Configuration
Devices and software should be configured securely rather than simply relying on manufacturer defaults.
Remove unnecessary software and services, change insecure default settings and disable unnecessary functionality.
Ask: Are our devices configured for security or simply configured to work?
3. Security Update Management
Software must be supported and security updates applied within the required timeframe.
Pay particular attention to critical and high-risk vulnerabilities subject to the Cyber Essentials 14-day rule.
Ask: Could we identify a vulnerable application and prove that it had been updated?
4. User Access Control
Users should only have access to the systems and information they genuinely require.
Administrator privileges should be tightly controlled and unused accounts removed.
Ask: Does everybody still need the access they currently have?
5. Malware Protection
Devices must have appropriate protection against malware.
Depending upon the device and environment, this might involve anti-malware software, application allow-listing or other approved approaches.
Ask: What prevents malicious software from executing on our devices?
Final Evidence & Assessment Checks
Before beginning your assessment, perform a final review.
Confirm that:
- Your scope is clearly defined.
- Your asset and software information is current.
- Unsupported software has been removed or replaced.
- Firewalls are appropriately configured.
- Unnecessary services and applications have been removed.
- Critical security updates have been applied.
- User accounts and privileges have been reviewed.
- MFA is appropriately enforced.
- Malware protection is operating.
- You can support your assessment answers with appropriate evidence.
Most importantly, make sure your answers describe what is actually happening within your environment, rather than what company policy says should happen.
How SecureX7 Helps
SecureX7 can help remove much of the uncertainty from assessment preparation by continuously assessing assets, vulnerabilities and security configuration.
SecureX7 will methodically guide you through the steps you need to achieve full compliance with Cyber Essentials and will continue to monitor your entire estate for any drift that may introduce new risks and vulnerabilities.
Instead of asking:
"Do we think we're compliant?"
SecureX7 helps you answer:
"What does our actual security posture show?"
Discover → Assess → Remediate → Reassess → Prepare
