Cyber Essentials self-check

1. Scope

Are end-user devices, cloud services, and home / BYOD workers that handle company data in scope?

Forgotten SaaS, MSP accounts, and personal laptops used for email are where assessments go wrong.

2. Secure configuration · auto-fail

Is every in-scope device and cloud app still vendor-supported?

Unsupported software in scope is an auto-fail from the April 2026 requirements.

3. User access control · auto-fail

Is MFA on for every cloud service that offers it, including Microsoft 365, VPN, and admin portals?

Leaving MFA off a cloud service that offers it is an auto-fail in 2026.

4. Security update management · auto-fail

Are critical and high-risk updates installed within 14 days of release?

The 14-day window is now an auto-fail. 'We patch monthly' is not enough.

5. Firewalls

Is the boundary firewall (and host firewalls) on, with default-deny inbound and admin access restricted?

Home routers for remote workers count. Default admin passwords on the firewall fail the control.

6. User access control

Do standard users run day-to-day work, with unique admin accounts and no shared local admin password?

Shared local admin is pass-the-hash fuel. Use Windows LAPS. See the LAPS post and calculator.

7. Malware protection

Is malware protection on every in-scope device, with web/email scanning and users unable to disable it?

CE+ tests this on a sample of devices, including whether a standard user can switch it off.

8. Secure configuration

Are default accounts disabled, auto-run off, and unused services removed or blocked?

The assessor will try common hardening misses on a sample of laptops.