Cyber Essentials Certification Checklist Template

What the Cyber Essentials Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope & Set Up the Assessment

   7 tasks

   Answers on the first task decide whether Phase 6 appears and switch on the renewal, sub-set, legal entity and supplier account tasks.

   • Record the level, the reason and the deadline — with or without Plus, who is asking for it, and any expiry date to beat
   • Review last year’s answers and assessor feedback — every answer must be entered again, and questions may have changed
   • Decide whole organisation or a sub-set — a sub-set must be segregated by a firewall or VLAN and justified to the assessor (A2.1, A2.2)
   • Describe the excluded networks and how they are segregated — this description is not published (A2.2.1)
   • List every legal entity in scope — name, address and company number; an entity left off cannot be added after certification (A1.6)
   • Build the in-scope inventory — networks, firewalls and routers by model, servers, end-user and BYOD devices, with operating systems (A2.4–A2.8)
   • List every cloud service and name the in-house IT lead — cloud services cannot be excluded, and the IT lead cannot be employed by your outsourced provider (A2.9, A2.10)
2. 2
   Phase 2

   Phase 2: Firewalls & Secure Configuration

   6 tasks

   • Confirm a firewall protects every in-scope device — boundary firewalls, plus software firewalls on computers and servers (A4.1, A4.1.1)
   • Replace default firewall and router passwords — or disable remote administration entirely (A4.2, A4.3)
   • Keep firewall admin interfaces off the internet — unless a documented business need exists and MFA or an IP allow list protects them (A4.9–A4.11)
   • Review inbound firewall rules — each approved and documented with its business need; remove the rest (A4.6–A4.8)
   • Remove unused software, services and accounts — and disable auto-run of downloaded files (A5.1, A5.2, A5.8)
   • Set device locking — biometric, or a PIN or password of at least six characters, with throttling or lock-out (A5.9, A5.10)
3. 3
   Phase 3

   Phase 3: Security Update Management

   6 tasks

   A6.4 and A6.5 are automatic fails. Attach patch reports that show the 14 days were met, not a policy.

   • Confirm every operating system and firmware version is supported — check end-of-life dates and keep any extended security update subscription current (A6.1)
   • Record browsers, malware protection and office applications with versions — so the assessor can confirm they are supported (A6.2)
   • Remove unsupported or unlicensed software — or move it into a sub-set with no traffic to or from the internet (A6.3, A6.6, A6.7)
   • Turn on automatic updates wherever the software allows it — operating systems and applications (A6.4.1, A6.5.1)
   • Evidence the 14-day rule for operating systems and firmware — updates rated critical or high risk, CVSS v3 7 or above, or unrated by the vendor (A6.4)
   • Evidence the 14-day rule for applications — including associated files and extensions (A6.5)
4. 4
   Phase 4

   Phase 4: User Access Control & MFA

   7 tasks

   A7.16 and A7.17 are automatic fails. The last task appears only when a third party manages or supports your IT.

   • Confirm accounts are approved before creation and disabled on leaving — including after a defined period of inactivity (A7.1, A7.3)
   • Separate administrator accounts from everyday accounts — no email or web browsing on admin accounts, cloud admin included (A7.6, A7.7)
   • Review who holds administrator access — keep a tracked list and remove what the role does not need (A7.8, A7.9)
   • Check password controls — MFA, or at least 12 characters, or 8 with a deny list of common passwords, plus brute-force protection (A7.10, A7.11)
   • Switch on MFA for every user and administrator of every cloud service — free or paid, or linked to another service’s MFA (A7.14, A7.16, A7.17)
   • List cloud services with no MFA option at all — listing a service that does offer MFA fails the assessment (A7.15)
   • Bring supplier and MSP accounts under the same controls — accounts you own are in scope even when a third party uses them to support you
5. 5
   Phase 5

   Phase 5: Malware Protection, Sign-Off & Submission

   6 tasks

   • Confirm malware protection on every device — anti-malware that blocks malicious code and websites, or application allow listing (A8.1–A8.5)
   • Draft every answer offline from the question set — with evidence for each, before paying for the assessment account
   • Decide on the included cyber liability insurance — available when the whole organisation is certified, UK-domiciled, with turnover under £20m (A3)
   • Obtain board-level approval of the answers — the declaration now covers staying compliant for the whole certificate year
   • Submit within the account’s six-month window — marking takes about three working days; a fail allows two working days to fix and resubmit
   • Record the certificate number and issue date — the issue date is the scheme’s “point in time”, and the expiry is 12 months later
6. 6
   Phase 6 — Plus Only

   Phase 6: Cyber Essentials Plus Audit

   6 tasks

   Shown only when Phase 1 records Plus. The booking task falls due three months after the Phase 5 certificate date.

   • Book the audit within three months of the self-assessment certificate — or run both together
   • Freeze the self-assessment answers — they must be final before testing starts and cannot be changed to match the results
   • Prepare devices, users and access — a representative sample, one standard and one admin user per cloud service, written permission
   • Run your own checks before the assessor does — missing 14-day fixes, MFA prompts in a private browser session, and admin rights on standard accounts
   • Fix failures across the whole scope, not just the sample — a retest rechecks the original devices and a new random sample
   • Record the Plus report and certificate — advisory notes become next year’s starting list
7. 7
   Phase 7 — Through the Year

   Phase 7: Stay Compliant & Renew

   5 tasks

   The certificate is a point-in-time check, but the declaration covers the year. Run the fortnightly check as its own recurring checklist and attach the runs here.

   • Check patching and cloud MFA every fortnight — missed high-risk updates, cloud services without MFA, software nearing end of life
   • Update the scope record after significant change — new sites, entities, cloud services or device types
   • Review administrator access and firewall rules at a set interval — quarterly is a common choice
   • Check which requirements version applies before renewing — the scheme is reviewed every year
   • Start the renewal two months before expiry — a lapsed certificate can breach a contract requiring annual renewal