Although Cyber Essentials certification has been around for a while it's becoming more prominent among the businesses recently. We have been getting increased amount of enquiries about the certification of late. There is lots of information available on the NCSC website, IASME website and internet in general and yet many organisations are not clear on what exactly is needed in order to achieve the certification. We made a checklist a few years ago which was very popular and we now updated the checklist for 2023. Please note there will be changes coming to Cyber Essentials scheme in April 2023 and we will be updating this blog accordingly.

So what's needed to pass the certification? Here is the checklist. You can also download the PDF version here. There are essentially 5 different security controls in the framework and if you tick all the boxes below you are pretty much ready to achieve the certification. Here they are

DOWNLOAD THE CYBER ESSENTIALS PLUS REQUIREMENTS 2023 PDF COPY

1. FIREWALLS

• Default passwords are changed
• Unnecessary ports are closed
• Port opening process documented
  
• IP allow list for Remote access or MFA enabled
• Unauthenticated inbound traffic blocked
  
• Removed unnecessary firewall rules
• Protecting devices offsite/home-based workers
• Document business case for any new services

2. SECURE CONFIGURATION

• Changed the default login credentials
• Removed the unnecessary software
• Disabled the unused user accounts
• Enforced strong password policy
• Disabled the auto-run feature
• Set-up device locking
• Have protection against brute-force attack