What is the Cyber Essentials self-assessment checklist?

It's a free, 25-point checklist covering everything Cyber Essentials asks for, grouped under the five controls (firewalls, secure configuration, security update management, user access control and malware protection). Score each line Yes, No or Unsure and you'll see exactly what would stop you certifying today.

Is this the official Cyber Essentials assessment?

No — the official assessment is a self-assessment questionnaire verified by an IASME-accredited certification body. This checklist gets you ready for it: clear these 25 points and you're in good shape to certify.

What if I score amber or red on several lines?

That's completely normal, and it's all fixable. Our free Cyber Essentials gap-check runs an external security baseline and gives you a prioritised fix list; then we help you close the gaps. Certification itself is issued by an IASME body.

Free · 25 points · UK SMEs

Are you Cyber Essentials ready?

The 25-point self-assessment checklist

Score each line Yes, No or Unsure. Every “No” or “Unsure” is exactly what would stop you certifying — and exactly what we help you fix. Genuinely useful on its own; even more so with our help.

Email me the printable one-pager (and occasional CE tips):

Download PDF

Y = YesN = No? = Unsure

Firewalls & internet gateways

Control the traffic in and out of your networks and devices.

Every device has a firewall enabled (office and home/remote).YN?
Default admin passwords on routers and firewalls have been changed.YN?
No unnecessary ports or services are open to the internet.YN?
Remote access is via VPN or an allow-list — not exposed directly.YN?
Home-working devices have their software firewall switched on.YN?

Secure configuration

Remove the easy wins an attacker looks for first.

Unused software, accounts and services have been removed.YN?
All default and shared passwords have been changed.YN?
Auto-run / auto-play is disabled so untrusted media can't run itself.YN?
Devices auto-lock after a short period of inactivity.YN?
Only the software and accounts people actually need are present.YN?

Security update management

Unpatched software is the most common way in.

All software and operating systems are still vendor-supported (nothing end-of-life).YN?
Security updates are applied within 14 days of release.YN?
Automatic updates are switched on wherever possible.YN?
Unsupported or unused applications have been removed.YN?
Router / firewall firmware is kept up to date.YN?

User access control

People should only have the access they need — and nothing more.

Everyone has their own named account (no shared logins).YN?
Admin rights are only granted where genuinely needed.YN?
Admin accounts are separate from everyday accounts.YN?
MFA is enabled on email and all cloud services.YN?
Leavers' accounts are disabled promptly.YN?

Malware protection

Stop malicious software running on your devices.

Anti-malware is installed and updating on all devices.YN?
Only approved software can be installed.YN?
Email and web filtering blocks malicious links and attachments.YN?
Devices only run applications from trusted sources.YN?
Mobile devices are covered too (MDM or equivalent).YN?

How did you score?

Mostly green? You're likely close — certification is often just 2–3 weeks away. Amber or red on several lines? That's normal. Most amber items take 2–4 weeks to fix; reds usually need budget. Book a 20-minute call and we'll map your specific path to certified.

Cyber Essentials is now required for many government and supply-chain contracts, and must be renewed every year.

Get your free gap-check Book a free 20-minute gap call