Cyber Essentials requirements (v3.3, 2026): the five controls, translated

Where the requirements come from

Two documents define Cyber Essentials. The NCSC publishes the Requirements for IT Infrastructure — currently version 3.3, in force from April 2026 — which sets out what must be true of your devices, network and cloud services. IASME publishes the question set (the 2026 one is “Danzell”) that turns those requirements into the self-assessment. Both are linked under Sources at the bottom of this page; everything below is a translation, not a replacement.

The requirements apply to everything in scope: your laptops, desktops, phones and tablets (including personal ones used for work), your routers and firewalls, any servers, and every cloud service that holds business data. The scope guide covers what is in and out, and the cloud services guide explains why email, file storage and business social accounts can never be excluded.

The requirements at a glance

Everything the 2026 requirements ask of a typical small business, in one list. Each line is expanded in its control’s section below.

• A firewall between your network and the internet (usually your router), the software firewall on each computer switched on, and the router’s admin password changed from the default.
• Inbound connections blocked by default; any opened rule documented, approved and reviewed at least every 12 months; internet-facing admin interfaces switched off, or kept only for a documented business need and protected by MFA or an IP allow-list plus a strong password.
• Unused software and accounts removed, every default password changed, auto-run disabled, and every device locking with biometrics, a password or a PIN of at least 6 characters (a PIN that short is only enough where it just unlocks the device).
• Password quality by one of three controls: MFA; a 12-character minimum; or an 8-character minimum plus a common-password deny list. Brute-force protection by MFA, throttling (no more than 10 guesses in 5 minutes), or lockout after no more than 10 attempts. No expiry, no complexity rules.
• MFA on for every user and every admin of every cloud service that offers it — an automatic fail otherwise (A7.15–A7.17).
• Individual logins for everyone, admin accounts separate from everyday ones and never used for email or browsing, a joiner/leaver process, and least privilege.
• Anti-malware or app allow-listing on every device — Defender counts; for phones, official app stores plus a list of apps your business has approved (A8.4, A8.5).
• Everything supported by its maker, and security updates installed within 14 days when they are high-risk (CVSS 7+, or vendor critical/high) or the vendor gives no severity rating — automatic fails otherwise (A6.1, A6.4, A6.5). Covers OS, apps, browsers, plug-ins and firmware.
• A scope covering every end-user device (personal phones with work email included), every router you own, any servers, and every cloud service — cloud services cannot be excluded.

That is the whole scheme. Nothing on this list needs an IT department; most of it is settings in software you already have. The interactive checklist has the same list as tick-boxes with every official question number.

Control 1 — Firewalls (questions A4.x)

Requirement: every in-scope device is protected by a correctly configured firewall — a boundary firewall (usually your router) between your network and the internet, and the software firewall on each computer. The firewall’s default administrator password is changed, and the new one meets the password rule. Inbound connections from the internet are blocked by default; any rule you open has a documented business reason and is removed when no longer needed, and the rules are reviewed at least every twelve months. If the firewall can be administered over the internet, that needs a documented business reason and protection by MFA, or by an IP allow-list plus a properly managed password — otherwise it is switched off.

For a small office this is almost entirely the provider’s router: change its admin password, leave inbound blocked (the default), and make a note that you checked its rules. Anything reachable from outside — a server, remote desktop, a camera system — is the exception that needs a careful look. The Cyber Essentials firewall requirements guide goes through each A4 question with the router settings that answer it, and the home workers guide covers whose router counts when people work from home.

Control 2 — Secure configuration (A5.x)

Requirement: remove or disable software, services and accounts that are not needed; change all default passwords; make sure anything exposed to the internet requires authentication; have a way to change a password quickly if it is compromised; protect logins against guessing (MFA, throttling to no more than 10 guesses in 5 minutes, or lockout after no more than 10 attempts); disable auto-run so removable media cannot execute software automatically; and lock every device, unlocking it with biometrics, a password or a PIN of at least 6 characters where it only unlocks the device (if the same credential also signs in to work data, the full password rules apply).

For a small business this is an afternoon of settings: uninstall what you don’t use, delete old accounts, set screen locks on every phone and laptop, and confirm USB auto-run is off. The secure configuration guide walks through those settings, and the mobile device requirements cover the passcode, app-store and supported-OS rules that apply to every phone and tablet in scope — including personal phones used for work (BYOD).

Control 3 — User access control (A7.x)

Requirement: accounts are created through an approval process and removed promptly when people leave; everyone has their own login; people have only the access they need; administrator accounts are separate from everyday accounts, are not used for email or browsing, are listed, and are reviewed. Password quality is managed by one of three technical controls: MFA; a minimum length of 12 characters; or a minimum of 8 characters plus automatic blocking of common passwords. Staff are encouraged to choose strong, unique passwords (three random words), with no forced expiry and no complexity rules. And MFA is switched on for every user and every administrator of every cloud service that offers it — asked at A7.14 to A7.17, with A7.15, A7.16 and A7.17 automatic fails.

For a small business the MFA part is the work: go through every cloud service, every account, and turn it on. The MFA guide lists the accounts people forget. The Cyber Essentials password policy guide explains the three password controls and which to pick, and the password policy generator writes the policy.

Control 4 — Malware protection (A8.x)

Requirement: every device is protected by at least one of: anti-malware software that updates itself automatically, prevents malware running, and blocks access to known-malicious websites; or application allow-listing, where only approved, signed applications can run and the approved list is maintained. Phones and tablets that only install from the official app store, and are not jailbroken or rooted, meet the second only if you also keep a list of approved apps and staff install only those (A8.4, A8.5).

For a small business: Windows Defender is built in and counts; Macs need one of the two options as well (the Cyber Essentials malware protection guide covers both); phones stay on the official stores, installing only apps on your approved list.

Control 5 — Security update management (A6.x)

Requirement: all software in scope — operating systems, applications, browsers, plug-ins and extensions, and router and firewall firmware — is licensed and supported by its maker. Security updates rated high or critical (CVSS v3 base score of 7 or above, or labelled critical or high by the vendor) — and any security update the vendor gives no severity rating — are installed within 14 days of release, including any vendor-recommended configuration changes. Unsupported software is removed, updated, or moved out of scope onto a segregated network with no internet access. Questions A6.1, A6.4 and A6.5 are automatic fails.

For a small business: automatic updates on everywhere, restart when asked, and deal with any device on a retired operating system — see the unsupported software guide and the list of supported operating systems. The 14-day patching guide covers what “within 14 days” means in practice.

What the requirements do not include

A surprising amount of online advice adds things. The requirements do not require backups (recommended, not a technical requirement), staff training, penetration testing, a risk register, an information-security policy suite, password expiry, password complexity, a 14-character password minimum, or any particular product. Cyber Essentials is deliberately a baseline: five controls, applied to everything in scope, done properly.

What v3.3 changed, and what was already true

The NCSC lists these as new in version 3.3 of the requirements:

• A definition of “cloud services”, and a definitive statement that cloud services cannot be excluded from scope.
• An updated definition of passwordless sign-in that includes FIDO2 (passkeys).
• The scope criteria no longer refer to “untrusted connections”.
• A Software Security Code of Practice in the software development section, and more emphasis on backing up data (recommended, still not a requirement).

These are not new in v3.3, but they are the rules that most often catch businesses out:

• MFA on every cloud service that offers it, with A7.15, A7.16 and A7.17 automatic fails.
• The 14-day rule for high-risk and unrated security updates (A6.4, A6.5), covering firmware, browsers and plug-ins.
• Password quality by one of three technical controls, with no expiry or complexity rules.
• A scope that includes end-user devices, personal devices that access work data, and business social-media accounts as cloud services.

The changes guide explains each, with what to do about it.