FREE TOOL · NO SIGN-UP

Cyber Essentials Checklist

Work through the scope rules and the five Cyber Essentials controls, as set out in the NCSC's requirements v3.3 (April 2026), and see where your business stands before you apply. Your answers stay in this browser.

Cyber Essentials Plus certified badge: Omega IT, 2026, certified via CyberSmart

Omega IT is Cyber Essentials Plus certified (2026, via CyberSmart), the independently tested level of the scheme.

Your progress

0 of 27 in place (0%)

Scope and cloud services

0/3

You've decided what's in scope: every device that accesses your organisation's data or services, including laptops, desktops, phones and tablets used for work. Staff devices can't be left out.
IASME question A2
Every cloud service that stores or processes your data (for example Microsoft 365, Google Workspace or Dropbox) is in scope. Since April 2026, cloud services can't be excluded.
IASME question A2
You keep an up-to-date list of in-scope devices (make and operating system), and the make and model of your firewalls and routers.
IASME question A2

Firewalls

0/4

Every in-scope device is protected by a correctly configured firewall: a boundary firewall, or the device's own software firewall when it's used on networks you don't control, such as public wifi.
IASME question A4
Default administrative passwords on firewalls and routers have been changed to strong, unique ones, or remote administration is turned off.
IASME question A4
Firewall admin interfaces can't be reached from the internet, unless there's a documented business need and access is protected by MFA or an IP allow list.
IASME question A4.9, A4.10
Unauthenticated inbound connections are blocked by default. Each inbound rule is approved by an authorised person, documented with its business need, and removed when it's no longer needed.
IASME question A4.5–A4.7

Secure configuration

0/5

Unnecessary user accounts, such as guest accounts and unused admin accounts, are removed or disabled.
IASME question A5
Default or guessable passwords have been changed on all devices and software.
IASME question A5
Unnecessary software, system utilities and network services are removed or disabled.
IASME question A5
Auto-run is disabled, so downloaded or imported files can't run without the user's say-so.
IASME question A5.8
Devices need a PIN, password or biometric to unlock (at least 6 characters for an unlock-only PIN or password), with lockout after no more than 10 attempts or throttling to 10 guesses in 5 minutes.
IASME question A5.9, A5.10

Security update management

0/5

All operating systems, software and cloud services are licensed and supported by a vendor that releases security fixes.
IASME question A6.1–A6.3
Unsupported software has been removed, or the devices running it are taken out of scope and cut off from the internet.
IASME question A6.6, A6.7
Automatic updates are switched on wherever possible.
IASME question A6.4.1, A6.5.1
Critical and high-risk updates for operating systems and router and firewall firmware are installed within 14 days of release.
IASME question A6.4A "no" fails the assessment
Critical and high-risk updates for applications, including their files and extensions, are installed within 14 days of release. Updates the vendor doesn't rate count as critical.
IASME question A6.5A "no" fails the assessment

User access control

0/7

There's a process to create and approve user accounts, and everyone signs in with their own unique credentials, including third parties such as support providers.
IASME question A7.1, A7.2
Accounts are removed or disabled when someone leaves or no longer needs them, and extra privileges are removed when a role changes.
IASME question A7.3, A7.4
Administrators use separate admin accounts for admin tasks only, not for email or web browsing, and you track and regularly review who has admin rights.
IASME question A7.6–A7.9
MFA is switched on for every administrator of every cloud service that offers it, whether it's free, included or a paid option.
IASME question A7.16A "no" fails the assessment
MFA is switched on for every user of every cloud service that offers it, including part-time staff and contractors.
IASME question A7.17A "no" fails the assessment
Passwords are protected against brute force (MFA, throttling or lockout after 10 attempts), and their quality is managed: MFA, or at least 12 characters, or at least 8 characters with common passwords blocked, never with a maximum length.
IASME question A7.10, A7.11
People are helped to choose unique passwords, for example three random words and a password manager, without forced expiry or complexity rules, and there's a process to change passwords quickly if an account may be compromised.
IASME question A7.12, A7.13

Malware protection

0/3

Every in-scope device has active malware protection: anti-malware software (on Windows and macOS) or application allow listing.
IASME question A8.1
Anti-malware software is kept up to date and set to stop malware running, block malicious code, and warn about or block malicious websites.
IASME question A8.2, A8.3
Where you use allow listing or app stores, only approved, code-signed applications can run, and users can't install unsigned apps.
IASME question A8.4

Not sure where to start?

Talk to us about closing the gaps before you apply.

Cyber Essentials vs Cyber Essentials PlusCyber security services

Get IT support

or call 0800 254 5458

Sources

This checklist summarises the official requirements to help you prepare. It isn't a substitute for them or for the assessment itself.

Cyber Essentials checklist FAQs

What is Cyber Essentials?

Cyber Essentials is the UK Government-backed scheme, run by the NCSC with its delivery partner IASME, that certifies an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.

Which version does this checklist follow?

The NCSC's Cyber Essentials Requirements for IT Infrastructure v3.3, which applies to assessment accounts created from 27 April 2026, and IASME's Danzell question set (v16.3). Applications started before then can still follow v3.2. The question numbers shown against each item refer to the IASME question set.

What changed in April 2026?

Cloud services are now formally defined and can't be excluded from scope. IASME's question set treats a missing MFA on any cloud service that offers it, for administrators or users, as an automatic fail, and the same applies to critical and high-risk updates not installed within 14 days.

What's the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five controls. Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus adds independent technical testing of your systems by an assessor.

Does completing this checklist mean we're certified?

No. It's a self-check to help you see where you stand before applying. Certification is assessed by a certification body licensed by IASME, against the current question set.

Is my progress saved?

Only in this browser, so you can come back to it. Nothing you tick is sent to Omega IT or stored on our servers.

Related service: Cyber security