Secure configuration: the afternoon of settings most businesses never did
This control has no drama in it — no auto-fails, no new kit — just the settings that were never looked at: software nobody uses, accounts nobody closed, passwords nobody changed, screens that don’t lock. Here is the A5 section as a to-do list.
The idea behind the control
Devices and services arrive configured for convenience, not safety: sample software pre-installed, default accounts enabled, helpful auto-run features switched on. Secure configuration is the discipline of turning a device into your device — running only what you need, reachable only by the people who should reach it. Every item below maps to a question in section A5 of the 2026 questionnaire.
Remove what you don’t use (A5.1)
Software you never open is pure risk: it still gets vulnerabilities, but nobody thinks to update it. Go through each computer’s installed apps (Windows: Settings → Apps → Installed apps; Mac: the Applications folder) and uninstall what the business doesn’t use — trials, pre-installed extras, tools from projects that ended. Do the same inside cloud services: integrations and connected apps you no longer use can usually be revoked from the service’s settings.
Only the accounts you actually need (A5.2)
Every login on every device and cloud service should belong to someone who works there now, plus any admin accounts you deliberately keep. Guest accounts, an ex-employee’s login, the “temp” account from an old project — remove or disable them. This overlaps with the leaver process in user access control; the difference is that here you go looking for the accounts everyone forgot exist.
Change every default password (A5.3)
Anything that shipped with a password — computers, phones, tablets and servers (A5.3), and your router (A4.2) — gets a new one that meets the password rule: MFA where possible, or at least 12 characters, or at least 8 with common passwords blocked. Do the same for printers with web pages, NAS boxes and camera systems as good practice. A unique-looking password printed on a sticker is still a default. The password requirements guide explains the three options.
Anything exposed to the internet needs a login (A5.4)
If something of yours can be reached from the internet — a remote-access service, a web interface, a file share — it must require authentication before giving anything away, and that login must meet the password rule (A5.5). Most small businesses expose nothing on purpose; if you are not sure whether you do, that is worth finding out before an assessor asks. The firewall guide covers the same ground from the network side.
Know what you’ll do about a leaked password (A5.6)
The questionnaire asks whether you have a way to change a password promptly when you suspect it is compromised. For a small business a sentence is enough — who changes it, where, and that recent sign-ins get checked — provided it is true and the team knows to speak up fast, no blame attached.
Protect any service you host from guessing (A5.7)
If you run something staff or customers log into over the internet — a VPN, a portal — and it doesn’t use MFA, it must throttle attempts (no more than 10 guesses in 5 minutes) or lock the account after 10 wrong tries. You just need to be able to say which applies. Most small businesses host nothing like this. Device lock screens are covered below (A5.10).
Disable auto-run (A5.8)
A plugged-in USB stick or a downloaded file must not run software by itself — either blocked outright or the computer asks first. Windows and macOS default to asking; the question is really checking nobody switched that off for convenience. Leave it asking.
Lock every screen (A5.9, A5.10)
Every computer, phone and tablet needs to unlock with a fingerprint, face, password or PIN. A PIN or password of at least 6 characters is fine when it only unlocks the device and work apps still need their own sign-in; if the device login is also the work login, the full password rules apply (A5.10). The unlock also needs protection against guessing: throttling (no more than 10 guesses in 5 minutes), locking after 10 failed attempts, or the maker’s built-in default where you can’t change it. On phones: Settings → Face ID / Touch ID & Passcode (iPhone) or Security / Screen lock (Android). On Windows: Settings → Accounts → Sign-in options. On a Mac: System Settings → Touch ID & Password. We recommend setting each device to lock automatically after a few minutes of no use. This applies to personal phones used for work too — they are in scope. The device unlocking guide goes through each unlock method in detail.
Doing the afternoon
The honest way to clear this section is device by device, not question by question: sit with each machine for ten minutes — uninstall, check accounts, check the lock, check auto-run — and tick it off in the checklist. Two people and a coffee clear a ten-device office in an afternoon, and everything you fix here also makes the free-text answers easy to write.
Frequently asked questions
What is secure configuration in Cyber Essentials?
The control that says devices and services should only do what you need them to: unnecessary software and accounts removed, default passwords changed, anything internet-facing behind authentication, auto-run disabled, and every device locking with a fingerprint, face, password or PIN.
What screen lock does Cyber Essentials require?
Every computer, phone and tablet must need biometrics, a password or a PIN to unlock. A PIN or password of at least 6 characters is fine where it only unlocks the device; if the same credential also signs in to work data, the full password rules apply.
Does Cyber Essentials require disabling USB auto-run?
Yes — devices must not automatically run software from removable media or downloads. Blocking it outright or prompting the user first both satisfy the requirement.
Do I have to delete old user accounts?
Accounts that are no longer needed should be removed or disabled — leftover guest accounts and ex-staff logins are exactly what the control is about.