Cyber Essentials checklist — the printable PDF version
The 50 things the 2026 Cyber Essentials self-assessment checks, as a paper form: one tick box per line, the official question number beside each, and the 6 automatic fails marked. Print it or save it as a PDF from your browser — no email, no account, nothing uploaded.
Cyber Essentials checklist (2026 question set) — readycert.co.uk · printed 2026-10-29. Preparation guidance, not a certificate.
The one-page checklist
50 items · 6 automatic fails markedScope: what you're certifyingA2 · 9 items
| Done | Question | What has to be true |
|---|---|---|
| A2.1 | Decided whether the whole organisation or a defined part of it is being certified. | |
| A2.3 | Listed every location the team works from, including home, and how each gets online. | |
| A2.4.1 | Counted home and remote workers and noted how they connect (home router, company router or VPN). | |
| A2.5 | Written down the make, model and number of every router and firewall. | |
| A2.6 | Listed every laptop and desktop with its make and the exact operating-system version. | |
| A2.7 | Noted any servers, virtual servers or hosted desktops — most small businesses have none. | |
| A2.8 | Listed every phone and tablet used for work — including personal ones that open work email or files — with make and OS version. | |
| A2.9 | Listed every cloud service the business uses, including business social-media accounts. | |
| A2.10 | Named the person responsible for IT within the scope. |
FirewallsA4 · 8 items
| Done | Question | What has to be true |
|---|---|---|
| A4.1 | Every in-scope device sits behind a firewall: the office router or firewall at the boundary, and the built-in software firewall switched on on each laptop and desktop. | |
| A4.2 | The admin password on every router and firewall has been changed from the default. | |
| A4.3 | That admin password meets the password rule: MFA, or at least 12 characters, or at least 8 characters with common passwords blocked. | |
| A4.4 | You know how to change the firewall password straight away if you ever suspect it has been compromised. | |
| A4.5 | Someone is responsible for managing the firewall, and its rules have been reviewed within the last 12 months. | |
| A4.7 | Inbound connections from the internet are blocked by default.Needs a look | |
| A4.8 | Any inbound rule you have deliberately opened is written down with a business reason and has been approved. | |
| A4.9 | If the router or firewall can be managed over the internet, there is a documented business need and that access is protected by MFA or an IP allow-list plus a properly managed password — or it is switched off.Needs a look |
Secure configurationA5 · 8 items
| Done | Question | What has to be true |
|---|---|---|
| A5.1 | Software and services not needed for day-to-day work have been removed or disabled on every device and cloud service. | |
| A5.2 | Only user accounts that are actually needed exist; unused accounts have been removed. | |
| A5.3 | Default passwords have been changed on every device and service, and the new ones meet the password rule. | |
| A5.4 | Anything you expose to the internet requires someone to authenticate before it gives access. | |
| A5.6 | There is a process for changing a password promptly when you think it may have been compromised. | |
| A5.7 | Any external service you host is protected against password guessing: MFA, throttling to no more than 10 guesses in 5 minutes, or locking the account after no more than 10 wrong attempts. | |
| A5.8 | Auto-run and auto-play are disabled, so a plugged-in USB stick or disc cannot run software by itself. | |
| A5.9 | Every device needs a fingerprint, face, password or PIN to unlock — a PIN or password of at least 6 characters is enough only where it just unlocks the device (A5.10). |
Security update managementA6 · 8 items
| Done | Question | What has to be true |
|---|---|---|
| A6.1 | Every operating system on every device — and the firmware on routers and firewalls — is still supported by its maker.Auto-fail | |
| A6.2 | Every application is supported and still receiving security updates — including browsers, anti-malware, email and office apps. | |
| A6.3 | No unlicensed or unsupported software is in use anywhere in scope. | |
| A6.4 | High-risk and critical security updates — and any security update the vendor doesn’t rate — for operating systems and router/firewall firmware are installed within 14 days of release.Auto-fail | |
| A6.4.1 | Automatic updates are switched on for every operating system wherever the device allows it (a manual process is only for devices that can’t, and must still meet the 14 days). | |
| A6.5 | High-risk and critical security updates — and any security update the vendor doesn’t rate — for applications are installed within 14 days of release.Auto-fail | |
| A6.5.1 | Automatic updates are switched on for applications, including browsers. | |
| A6.6 | Anything that is no longer supported has been removed, replaced, or moved out of scope onto a walled-off network with no internet access. |
User access controlA7 · 13 items
| Done | Question | What has to be true |
|---|---|---|
| A7.1 | New user accounts are only created through an approval process — a joiner process you could describe. | |
| A7.2 | Everyone has their own login. Nobody shares an account. | |
| A7.3 | When someone leaves, their accounts are disabled promptly — a leaver process you could describe. | |
| A7.4 | People only have access to the files, folders and apps they need for their job. | |
| A7.5 | Administrator accounts are created through a formal process, are separate from everyday accounts, are never used for email or web browsing, are tracked, and are reviewed regularly. | |
| A7.10 | Brute-force protection is in place on logins: MFA, throttling (no more than 10 guesses in 5 minutes), or lockout after no more than 10 attempts. | |
| A7.11 | Password quality is enforced by one of: MFA; a minimum of 12 characters; or a minimum of 8 characters plus automatic blocking of common passwords. | |
| A7.12 | Staff have been shown how to choose good passwords — three random words, never reused — and a password manager is encouraged. | |
| A7.13 | There is a process for what happens when a password or account may have been compromised. | |
| A7.14 | You know which of your cloud services offer MFA. Almost all of them do. | |
| A7.15 | Any cloud service you would list as “no MFA available” genuinely has no MFA option.Auto-fail | |
| A7.16 | MFA is switched on for every administrator account on every cloud service.Auto-fail | |
| A7.17 | MFA is switched on for every user account on every cloud service.Auto-fail |
Malware protectionA8 · 4 items
| Done | Question | What has to be true |
|---|---|---|
| A8.1 | Every computer, laptop, tablet and phone is protected by anti-malware software and/or only allows approved apps (signed or official-store apps, limited to a list your business approves). | |
| A8.2 | Anti-malware software updates itself automatically and is set to stop malware running. | |
| A8.3 | Anti-malware scans web pages and warns about or blocks connections to known-malicious websites. | |
| A8.4 | On devices that rely on an app store or allow-list, only signed and approved apps can be installed — no jailbroken or rooted devices — and the approved list is maintained, personal devices included. |
What is on the checklist
Cyber Essentials is assessed with a self-assessment questionnaire — the 2026 version is called “Danzell”, aligned to the NCSC’s Requirements for IT Infrastructure v3.3 — rather than a checklist. The questions are written for assessors and sit in five technical controls plus a scope section. This page turns them into 50 plain-English items grouped the same way, each carrying the official question reference (for example A7.16) so you or an assessor can check it against the IASME question set and the NCSC document linked under Sources.
Where a “no” fails the assessment outright — there are 6 of those: unsupported operating systems, high-risk security updates that take longer than 14 days, and any cloud account without multi-factor authentication — the item is marked Auto-fail. Those are the ones to walk round the office with first.
PDF or the interactive version?
This page is the version to print: it is laid out for paper, with a box to tick and one control per section. The interactive checklist has the same 50 items with ticks that stay saved in your browser and a progress count. Use whichever suits the job — a printout for the walk-round, the interactive one for tracking the fixes — and download the spreadsheet if someone else looks after your IT.
How to use it
- Start with scope. Before judging anything, list every device and cloud service that touches work data. Most surprises are things people forgot were in scope: a personal phone with work email on it, a business LinkedIn account, the router in a home office. The scope guide has worked examples.
- Tick only what is true today. “We’ll switch MFA on next week” is a gap, not a tick. The point of the checklist is to find gaps while they are cheap to fix.
- Clear the auto-fail items first. Each fails the assessment on its own, however good everything else is.
- Keep the printout. Dated and ticked, it is a useful record at renewal twelve months later, when the same questions come round again.
What the checklist is not
It is preparation guidance, written in ReadyCert’s own words from the official question set — not the official questionnaire, and not a certificate. Ticking every box does not mean you would pass; only an IASME-licensed certification body assesses and awards Cyber Essentials. The questionnaire guide goes through the core questions one by one, and the documents guide lists the short policies you will be asked to describe.
Frequently asked questions
Is there an official Cyber Essentials checklist PDF?
No. The official documents are the IASME self-assessment question set and the NCSC Requirements for IT Infrastructure (v3.3, April 2026), both linked under Sources. This checklist is written from them in plain English, with each item’s official question number, so it can be checked line by line — it is preparation guidance, not the questionnaire itself.
How do I save it as a PDF?
Press “Print / Save as PDF”, then choose “Save as PDF” as the printer in your browser’s print dialogue. The page is laid out for A4 with one control per section; headers, navigation and buttons are left off the printout.
Which items are automatic fails?
An unsupported operating system anywhere in scope (A6.1), high-risk or critical security updates — or updates with no severity rating — taking longer than 14 days (A6.4, A6.5), any cloud account without multi-factor authentication (A7.16, A7.17), and listing a service as having no MFA option when it does (A7.15). They are marked “Auto-fail” on the checklist.
Does ticking everything mean I would pass?
No tool can promise that. The checklist finds gaps before an assessor does; certification is assessed and awarded only by an IASME-licensed certification body.