Start ticking to see where you stand

Work through each control area below. When you're done, we'll show how ready you look and what to close off.

00Scope

Get the boundary clear before anything else.

A written list of the devices and cloud services in scope (including staff-owned devices used for work).
Home and hybrid workers, and the kit they use, are accounted for.
You know whether you're certifying the whole organisation or a defined, separable sub-set.

01Firewalls & routers

Default admin passwords changed on every boundary router/firewall.
No inbound internet services exposed without a documented business need.
Host firewall turned on for remote/home-working devices.
Firewall admin interface not reachable from the internet (or protected by MFA).

02Secure configuration

Unused accounts, software and services removed or disabled.
Default/vendor passwords changed everywhere; no shared generic logins.
Devices auto-lock and require a PIN, password or biometric.
Auto-run/auto-play of removable media disabled.
MFA switched on for cloud services and admin access.

03Security update management

All operating systems and software still supported and licensed.
Automatic updates enabled wherever possible.
High-risk/critical updates applied within about two weeks.
Any unpatchable/end-of-life software removed from scope.

04User access control

Every user has their own named account — no shared accounts.
Admin accounts are separate and used only for admin tasks.
A process to approve new accounts and remove leavers quickly.
MFA protects cloud and administrative accounts.
Access granted on a least-privilege basis.

05Malware protection

In-scope devices protected by up-to-date anti-malware, allow-listing or sandboxing.
Anti-malware updates automatically and scans are enabled.
Users can't easily install unapproved applications.

This is Forefront's own preparation checklist, not the official assessment. For the official questionnaire and the "Requirements for IT Infrastructure" standard, use the current IASME question set at iasme.co.uk/cyber-essentials. When you're ready, we'll run a full gap assessment and CE+ pre-validation so you pass first time.

Book a readiness call Take the scored 2-minute check

Cyber Essentials readiness checklist