Cyber Essentials Requirements Checklist for 2026 (v3.3)

Since April 2026 the Cyber Essentials question set follows version 3.3 of the NCSC requirements. This is every technical requirement, rewritten as a checklist a small business owner can work through with their IT support.

Cyber Essentials is built on five technical controls. Before you look at any of them, you need to decide what the assessment covers. Most failed or delayed applications trace back to scope, not to a single missing setting.

Step one: agree your scope

• Cover the whole organisation, or a clearly separated part of it with its own network boundary. Whole-organisation scope gives the strongest assurance.
• Include end-user devices. A scope without laptops, desktops, tablets and phones is not accepted.
• Include every cloud service that stores or processes your data. Under v3.3, cloud services cannot be excluded.
• Include personal devices that access work email or systems. Phones used only for calls, texts and MFA apps are out of scope.
• Include home workers' devices. Home routers are out of scope unless the business supplied them, so those laptops need a software firewall switched on.
• Include accounts used by your IT supplier or other third parties to manage your systems.

Control 1: Firewalls

• Every device in scope is protected by a firewall, either a boundary firewall such as your router or a software firewall on the device.
• Default admin passwords on routers and firewalls are changed to strong, unique passwords, or remote admin is disabled.
• The firewall admin interface is not reachable from the internet, unless there is a documented need and it is protected by MFA or an IP allow list.
• Unauthenticated inbound connections are blocked by default.
• Inbound rules are approved, documented with a business reason and removed when no longer needed.
• Software firewalls are on for any device used on public or home wifi.

Control 2: Secure configuration

• Unused accounts, including guest and spare admin accounts, are removed or disabled.
• Default and guessable passwords are changed.
• Software, utilities and services that are not needed are removed or disabled.
• Auto-run is disabled, so files do not execute without the user choosing to.
• Users authenticate before reaching organisational data or services.
• Devices lock with a PIN, password or biometric, with a minimum of six characters for unlock-only PINs.
• Unlock attempts are limited to no more than 10 guesses in five minutes, or the device locks after 10 failed attempts.

Control 3: Security update management

• All software is licensed and supported by a vendor that still issues security fixes.
• Unsupported software is removed, or isolated in a sub-set with no internet access.
• Automatic updates are switched on wherever possible.
• Critical and high-risk updates, or those with a CVSS v3 score of 7 or above, are installed within 14 days of release.
• Updates where the vendor gives no severity are also installed within 14 days.

Control 4: User access control

• There is a process for creating and approving user accounts.
• Everyone signs in with their own credentials. No shared logins.
• Accounts are removed or disabled when people leave or after a defined period of inactivity.
• Multi-factor authentication is used wherever it is available, and always for cloud services.
• Administrators use a separate account for admin work only, not for email or browsing.
• Admin rights are removed when someone changes role and no longer needs them.

Password rules

Where passwords are used, they must be protected against guessing by MFA, throttling or lockout. Password quality must be enforced by MFA, a minimum length of 12 characters, or a minimum of eight characters combined with blocking common passwords. There must be no maximum length. The standard also asks you not to force regular password changes or complexity rules, and to give staff a password manager or other secure storage.

Control 5: Malware protection

• Every device in scope has active malware protection.
• On Windows and macOS, anti-malware software is kept up to date, blocks malware and malicious code, and blocks connections to malicious websites.
• Alternatively, any device can use application allow listing, where only approved, code-signed applications can run.

What changed in v3.3

• A formal definition of cloud services, and a clear statement that they cannot be excluded from scope.
• Passwordless authentication now explicitly includes FIDO2 authenticators, which count as MFA.
• Scope no longer refers to "untrusted connections".
• Backups are still not required, but are strongly recommended.
• Software development guidance points to the Software Security Code of Practice.

How to use this checklist

Work through scope first, then each control, and note every "no" or "not sure". Those notes become your remediation plan. When every line is a confident yes, you are ready to answer the question set. If you are also considering the audited certificate, read Cyber Essentials vs Cyber Essentials Plus before you submit.

This checklist summarises the NCSC document Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Read more about the scheme on the NCSC website, or see how Robishto provides Cyber Essentials support for small businesses.