Cyber Essentials evidence checklist: what to collect before you apply

What Cyber Essentials asks for

Cyber Essentials is a UK government-backed scheme that checks whether an organisation has basic technical protections against common internet-based attacks. It is delivered through certification bodies licensed by the scheme operator, IASME, on behalf of the National Cyber Security Centre. There are two levels: Cyber Essentials, a verified self-assessment, and Cyber Essentials Plus, where a technical assessor tests your systems as well.

Most failed or delayed applications come down to the same thing: the organisation could not show clearly what is in scope, or could not produce evidence that a control is actually applied. This checklist helps you gather that before you start the questionnaire. Cybergaar helps organisations prepare, but only the certification body can award certification.

Step 1: define and document your scope

Scope is the most common source of problems, so settle it first. Write down:

• The legal entity and any subsidiaries covered by the certificate.
• Every laptop, desktop, server, phone and tablet that accesses organisational data, including personal devices used for work.
• Every office network, home-working arrangement and cloud service in use.
• Who has access to what, including contractors and third-party administrators.

Step 2: boundary firewalls and internet gateways

Evidence that traffic between your devices and the internet is controlled:

• A list of firewalls or router firewalls in use, including the firewall built into each laptop for home working.
• Confirmation that default administrator passwords have been changed.
• Evidence that administration of firewalls is not exposed to the internet without protection.
• A record of any inbound rules that allow access from the internet, with a business reason for each.

Step 3: secure configuration

• Unnecessary software, accounts and services removed or disabled.
• Default passwords changed on every device and service.
• Password policy or technical controls that block weak or guessed passwords.
• Automatic screen lock on devices, and auto-run disabled for removable media.
• An inventory of installed software and who approved it.

Step 4: user access control

• A list of user accounts, with leavers removed promptly.
• Separate administrator accounts that are not used for email or web browsing.
• Multi-factor authentication enabled on all cloud services that support it, which the scheme requires, and on administrator accounts.
• A record of who has administrative rights and why.

Step 5: malware protection

• Anti-malware software, or an approved application allow-listing approach, installed and active on in-scope devices.
• Evidence that protection updates automatically and scans files when they are accessed.
• For mobile devices, apps installed only from approved stores, or a managed allow-list.

Step 6: security update management

This control catches many applicants. Operating systems, applications and firmware must be supported and kept up to date.

• Every device and piece of software is a supported version. Unsupported software must be removed or isolated from the internet.
• Critical and high-risk updates are applied within 14 days of release.
• Automatic updates are switched on where possible, with evidence such as a patch report or screenshot.
• Licensed software is used throughout, with end-of-life dates tracked.

Cyber Essentials Plus: what changes

For the Plus level, an assessor will check a sample of your devices and test your internet-facing systems directly. Expect them to verify patch levels, malware protection, and whether harmful email or web content is blocked. Run your own vulnerability scan and fix what it finds before the assessment, because failures found on the day can mean a retest.

Evidence checklist at a glance

• Scope statement and asset inventory.
• Firewall configuration and rule review records.
• Account list, admin account list and joiner-and-leaver records.
• MFA settings for each cloud service.
• Anti-malware and patch status reports for sampled devices.
• Software inventory with supported versions and end-of-life dates.
• Sign-off by a senior person who is accountable for the answers.

Common reasons applications fail

• Unsupported operating systems or software still in use on in-scope devices.
• MFA not turned on for email or cloud services.
• Home-working devices left out of scope.
• Shared administrator accounts and default passwords left unchanged.
• Answers given from memory with no evidence to support them.