Certifications & Compliance 

1 - Firewalls & Internet Gateways

Protect your network by controlling incoming and outgoing traffic.

Requirements:

• Change default passwords on routers and firewalls.

• Only allow essential services, ports, and protocols.

• Use Network Address Translation (NAT) or similar protections.

• Keep firewall logs and review them regularly.

3 - User Access Control

Limit access to only what’s necessary for each user.

Requirements:

• Provide each user with a unique login.

• Restrict admin privileges to essential staff only.

• Use separate accounts for admin and everyday use.

• Remove or disable accounts when staff leave or change roles.

• Enforce strong, complex passwords or passphrases.

5 - Patch Management

Keep your systems and software updated and secure.

Requirements:

• Ensure all software and operating systems are supported.

• Turn on automatic updates where possible.

• Apply critical security patches within 14 days of release.

• Regularly check for missing updates.

• Remove unsupported or end-of-life systems.

2 - Secure Configuration

Ensure systems are set up securely, reducing vulnerabilities.

Requirements:

• Remove or disable default accounts and unused services.

• Enforce strong password policies.

• Enable automatic screen locks on devices.

• Keep systems configured with minimal, secure settings.

4 - Malware Protection

Protect systems against viruses, ransomware, and other malicious software.

Requirements:

• Install and update anti-malware software on all devices.

• Enable real-time protection and regular scans.

• Scan all downloads and external media automatically.

• Use trusted app stores or verified software sources only.

• Provide basic cybersecurity awareness training to employees.

Additional Preparation Steps

Before submitting your certification:

• Assign a cybersecurity lead or team.

• Create an asset register listing all devices and software.

• Document your password, update, and incident response policies.

• Conduct a self-audit using the checklist above.

• For Cyber Essentials Plus, prepare for an external audit and vulnerability scan.