Cyber Essentials Checklist 2026: Every Requirement (v3.3)

To pass Cyber Essentials, every device and cloud service in your scope must meet the requirements under five controls. This checklist lists them all in plain English. Work through it, fix every unticked item, and only then apply.

Applies to routers, firewalls, desktops, laptops, servers and cloud services.

• Every device is protected by a firewall, either the office router/firewall or the device's built-in software firewall
• The software firewall is on for every laptop used at home or on public Wi-Fi
• The default admin password on routers and firewalls has been changed to a strong, unique one
• The router admin page can't be reached from the internet, unless it's protected by MFA or an IP allow-list and the business need is documented
• Unrequested inbound connections are blocked by default
• Every inbound rule or port forward is approved by a named person, with the business reason written down
• Rules that are no longer needed have been removed

Applies to servers, desktops, laptops, tablets, phones, thin clients and cloud services.

• Unused accounts (guest accounts, old staff, spare admin accounts) are removed or disabled
• No device or service uses a default or easy-to-guess password
• Software, apps and services you don't need are removed or disabled
• Auto-run is disabled, so files can't run without the user's say-so
• Users must sign in before they can reach business data or services
• Every device has a lock: a password, PIN or biometric. PINs and device passwords are at least 6 characters
• Devices lock, or slow down further attempts, after no more than 10 wrong guesses (no more than 10 in 5 minutes)

Applies to servers, desktops, laptops, tablets, phones, firewalls, routers and cloud services.

• All software is licensed and still supported by its vendor
• Unsupported software is removed, or isolated on a network with no internet access
• Automatic updates are switched on wherever possible
• Updates rated high or critical (CVSS v3 score of 7 or above), or with no severity given, are installed within 14 days of release
• You have a way to check updates actually ran, such as a monthly check or a patching report

Applies to servers, desktops, laptops, tablets, phones and cloud services.

• There's a process for creating and approving new user accounts
• Everyone signs in with their own unique account. No shared logins
• Accounts are removed or disabled when someone leaves, or after a set period of inactivity
• MFA is switched on for every cloud service, for every user. This is mandatory
• Admin tasks are done from separate admin accounts, never used for email or web browsing
• Admin rights are removed when they're no longer needed, for example after a role change
• Accounts used by your IT provider or MSP are known and controlled
• Passwords are protected by MFA, or are at least 12 characters, or at least 8 characters with common passwords blocked
• There's a process to change a password quickly if it's compromised

Cyber Essentials does not want forced password expiry or complexity rules. Long passwords plus MFA are what count.

Every in-scope device needs at least one of these:

• Anti-malware (Windows and macOS): active, kept up to date, blocks malware and malicious code, and blocks connections to malicious websites. Microsoft Defender counts if it's on and configured
• Application allow-listing (any device): only approved, code-signed apps can run, and you keep a current list. For phones and tablets, installing only from the official app store is the usual approach

The mistakes that cause most fails

• A forgotten cloud service with no MFA, such as an old Dropbox or the accounting app
• An unsupported operating system, like an old Windows 10 PC or an iPhone that no longer gets updates
• Staff phones with work email that weren't declared
• Answering with what you plan to do. The assessment checks what's in place today
• Vague answers like "we use antivirus" instead of naming the product and how it's configured

Source: NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Always check the latest version before you apply.