Are you ready for Cyber Essentials?

Do you know every device and cloud service used for work, including staff's own phones and laptops?

Personal devices that open work email or files count. Cloud services such as Microsoft 365 can't be left out.

Is every device protected by a correctly set-up firewall, including laptops used at home or on public Wi-Fi?

On Windows and Mac, the built-in firewall counts if it's switched on.

Have the default passwords on your router and firewall been changed, and is their admin page closed to the internet?

Have you removed or disabled accounts and software you don't use, and turned off auto-run?

Does every device need a PIN, password or fingerprint to unlock, and lock or slow down after 10 wrong guesses?

Is all your software and every operating system still supported and receiving security updates?

For example, Windows 10 needs Extended Security Updates now that standard support has ended.

Are critical and high-risk security updates installed within 14 days, with automatic updates switched on where possible?

Automatic fail, no chance to fix

This covers operating systems, apps, and router and firewall firmware.

Is multi-factor authentication switched on for every cloud service that offers it, such as Microsoft 365?

Automatic fail, no chance to fix

Do people with admin rights use a separate admin account, never used for email or web browsing?

Are accounts created through an approval process, and removed promptly when people leave?

Do passwords follow the rules: MFA, or at least 12 characters, or 8 characters with common passwords blocked?

Forcing regular password changes or complexity rules isn't required, and is discouraged.

Do all Windows and Mac devices have anti-malware running and up to date, such as Microsoft Defender?