Cyber Essentials Certification Checklist Template

Phase 1: Scope & Set Up the Assessment

Answers on the first task decide whether Phase 6 appears and switch on the renewal, sub-set, legal entity and supplier account tasks.

• Record the level, the reason and the deadline — with or without Plus, who is asking for it, and any expiry date to beat
• Review last year’s answers and assessor feedback — every answer must be entered again, and questions may have changed
• Decide whole organisation or a sub-set — a sub-set must be segregated by a firewall or VLAN and justified to the assessor (A2.1, A2.2)
• Describe the excluded networks and how they are segregated — this description is not published (A2.2.1)
• List every legal entity in scope — name, address and company number; an entity left off cannot be added after certification (A1.6)
• Build the in-scope inventory — networks, firewalls and routers by model, servers, end-user and BYOD devices, with operating systems (A2.4–A2.8)
• List every cloud service and name the in-house IT lead — cloud services cannot be excluded, and the IT lead cannot be employed by your outsourced provider (A2.9, A2.10)

Phase 2: Firewalls & Secure Configuration

• Confirm a firewall protects every in-scope device — boundary firewalls, plus software firewalls on computers and servers (A4.1, A4.1.1)
• Replace default firewall and router passwords — or disable remote administration entirely (A4.2, A4.3)
• Keep firewall admin interfaces off the internet — unless a documented business need exists and MFA or an IP allow list protects them (A4.9–A4.11)
• Review inbound firewall rules — each approved and documented with its business need; remove the rest (A4.6–A4.8)
• Remove unused software, services and accounts — and disable auto-run of downloaded files (A5.1, A5.2, A5.8)
• Set device locking — biometric, or a PIN or password of at least six characters, with throttling or lock-out (A5.9, A5.10)

Phase 3: Security Update Management

A6.4 and A6.5 are automatic fails. Attach patch reports that show the 14 days were met, not a policy.

• Confirm every operating system and firmware version is supported — check end-of-life dates and keep any extended security update subscription current (A6.1)
• Record browsers, malware protection and office applications with versions — so the assessor can confirm they are supported (A6.2)
• Remove unsupported or unlicensed software — or move it into a sub-set with no traffic to or from the internet (A6.3, A6.6, A6.7)
• Turn on automatic updates wherever the software allows it — operating systems and applications (A6.4.1, A6.5.1)
• Evidence the 14-day rule for operating systems and firmware — updates rated critical or high risk, CVSS v3 7 or above, or unrated by the vendor (A6.4)
• Evidence the 14-day rule for applications — including associated files and extensions (A6.5)

Phase 4: User Access Control & MFA

A7.16 and A7.17 are automatic fails. The last task appears only when a third party manages or supports your IT.

• Confirm accounts are approved before creation and disabled on leaving — including after a defined period of inactivity (A7.1, A7.3)
• Separate administrator accounts from everyday accounts — no email or web browsing on admin accounts, cloud admin included (A7.6, A7.7)
• Review who holds administrator access — keep a tracked list and remove what the role does not need (A7.8, A7.9)
• Check password controls — MFA, or at least 12 characters, or 8 with a deny list of common passwords, plus brute-force protection (A7.10, A7.11)
• Switch on MFA for every user and administrator of every cloud service — free or paid, or linked to another service’s MFA (A7.14, A7.16, A7.17)
• List cloud services with no MFA option at all — listing a service that does offer MFA fails the assessment (A7.15)
• Bring supplier and MSP accounts under the same controls — accounts you own are in scope even when a third party uses them to support you

Phase 5: Malware Protection, Sign-Off & Submission

• Confirm malware protection on every device — anti-malware that blocks malicious code and websites, or application allow listing (A8.1–A8.5)
• Draft every answer offline from the question set — with evidence for each, before paying for the assessment account
• Decide on the included cyber liability insurance — available when the whole organisation is certified, UK-domiciled, with turnover under £20m (A3)
• Obtain board-level approval of the answers — the declaration now covers staying compliant for the whole certificate year
• Submit within the account’s six-month window — marking takes about three working days; a fail allows two working days to fix and resubmit
• Record the certificate number and issue date — the issue date is the scheme’s “point in time”, and the expiry is 12 months later

Phase 6: Cyber Essentials Plus Audit

Shown only when Phase 1 records Plus. The booking task falls due three months after the Phase 5 certificate date.

• Book the audit within three months of the self-assessment certificate — or run both together
• Freeze the self-assessment answers — they must be final before testing starts and cannot be changed to match the results
• Prepare devices, users and access — a representative sample, one standard and one admin user per cloud service, written permission
• Run your own checks before the assessor does — missing 14-day fixes, MFA prompts in a private browser session, and admin rights on standard accounts
• Fix failures across the whole scope, not just the sample — a retest rechecks the original devices and a new random sample
• Record the Plus report and certificate — advisory notes become next year’s starting list