Course overview

Understand what Cyber Essentials is, who it is for, and what certification means for your organisation.

Get a practical overview of the five Cyber Essentials technical controls and how they shape your assessment.

Learn why Cyber Essentials certification matters commercially, operationally, and for stakeholder confidence.

Follow the end-to-end assessment process so you know what to prepare and what happens at each stage.

Compare Cyber Essentials and Cyber Essentials Plus to choose the right path for your organisation.

Avoid the most common mistakes that cause failed answers, rework, or delays during certification.

Capture the correct legal entity and certificate details so your application identity is accurate from the start.

Prepare essential organisation profile data including workforce, locations, sector, and public-facing details.

Understand when separate legal entities need separate assessments and how to avoid scope confusion.

Complete renewal and application context questions clearly so assessors can evaluate your submission quickly.

Answer cyber insurance-related questions accurately and understand how they connect to Cyber Essentials declarations.

Decide whether to certify the whole organisation or a defined subset, and document that scope clearly.

Identify sites, networks, and internet connections that must be represented correctly in your CE response.

Account for home and remote workers so all relevant users and connection paths are included in scope.

List network equipment accurately and avoid common inventory errors that weaken assessment evidence.

Record laptops, desktops, and virtual desktops properly so endpoint scope is complete and defensible.

Include thin clients, servers, and virtual servers with clear ownership and boundary definitions.

Handle tablets and mobile devices correctly, including BYOD and cloud access considerations.

Classify cloud services consistently across SaaS, PaaS, and IaaS so scope statements stay accurate.

Define internal and outsourced IT responsibilities so accountability and evidence ownership are clear.

Understand which systems firewalls protect and how boundary controls map to Cyber Essentials requirements.

Secure firewall administration by removing default credentials and tightly controlling remote admin access.

Control inbound connections and port forwarding with clear technical justification and risk awareness.

Run regular firewall rule reviews to remove obsolete access and keep security boundaries effective.

Apply software firewall requirements to user devices, especially laptops and remote endpoints.

Prepare firewall evidence and final checks that reduce common assessor queries and prevent avoidable failures.

Start secure configuration by removing default settings and high-risk options before they become weaknesses.

Identify and remove unnecessary accounts so only required users and privileges remain active.

Eliminate default and guessable passwords by enforcing stronger credential standards and controls.

Reduce attack surface by uninstalling unnecessary software, services, and system utilities.

Disable auto-run style behaviour that can execute untrusted files without explicit user approval.

Ensure users authenticate before accessing organisational services, data, or managed environments.

Strengthen device unlock controls with PIN/password/biometric policies and lockout safeguards.

Compile secure configuration evidence and perform final review checks before submission.

Apply least-privilege user access principles so accounts and permissions match real business need.

Set up account creation and approval workflows for joiners, movers, contractors, and temporary users.

Remove or disable leaver and dormant accounts promptly to prevent unnecessary residual access.

Implement multi-factor authentication where required, including cloud services and privileged access paths.

Enforce robust password-based authentication controls and supporting user guidance.

Separate administrative access from standard user access and control privileged account lifecycle tightly.

Complete final access-control assurance checks and gather evidence for assessment confidence.

Build and maintain an accurate device inventory so all in-scope assets are visible and governed.

Define approved software rules so only permitted applications are used across managed devices.

Control mobile software sources and app installation risks across phones and tablets.

Implement practical BYOD controls that protect organisational data on personally owned devices.

Manage device decommissioning and disposal securely, including account and data removal steps.

Choose the malware protection method that best fits your environment and Cyber Essentials obligations.

Configure and maintain anti-malware controls, updates, and blocking measures to meet CE expectations.

Apply allow-listing correctly so only trusted, approved applications can run.

Use application sandboxing and platform controls appropriately on supported device types.

Run final malware protection validation and evidence checks before submitting answers.

Understand the 14-day update rule and build a workable process for vulnerability remediation.

Create clear ownership for software inventory and patching across operating systems and applications.

Operate a repeatable patch workflow that handles exceptions while meeting CE timelines.

Manage unsupported software risk through isolation, replacement plans, and transparent declarations.

Complete final update-management checks so your submission is technically accurate and auditable.

Perform a final scope validation to confirm your answers match real systems, services, and responsibilities.

Assemble an evidence pack that maps clearly to each control and supports assessor review.

Complete the questionnaire with clear, consistent responses that minimise clarifications and rework.

Run a focused remediation sprint to close high-impact gaps before final submission.

Close the course with a practical recertification plan so controls stay effective year-round.