Lesson 5.8 — Secure configuration evidence, common failures and final review

This lesson closes the secure configuration module by helping the learner review all secure configuration answers before submission.

What You'll Be Able to Do

By the end of this lesson, you will be able to:

  • perform a final secure configuration review
  • confirm that evidence supports the answers being submitted
  • identify unresolved configuration gaps
  • avoid common failure patterns
  • assign ownership for maintaining secure configuration after certification.

Why This Matters

It explains what evidence should exist, what common secure configuration failures look like, how to check consistency against scope and inventory records, and how to decide whether the secure configuration section is ready for Cyber Essentials submission.

The Core Rule

The secure configuration module is about reducing unnecessary risk.

The final review checks whether in-scope devices, services and systems are configured safely and whether evidence supports the answers being submitted.

Copy This

Keep this rule visible:

Can we confidently show that in-scope devices, services and systems have been configured to remove unnecessary risk?

Quick Checklist

Before moving on, make sure you can say yes to these:

  • [ ] What is the main question in the final secure configuration review?
  • [ ] Why is a written policy alone not enough?
  • [ ] Why must secure configuration evidence match the scope?
  • [ ] Give three examples of secure configuration evidence.
  • [ ] What should not be stored in the evidence pack?

Your Action

Do this now — it takes 10–20 minutes.

Review your secure configuration evidence. Do you have documented settings, account records, and configuration baselines? Note any gaps.

Key Takeaway

Can we confidently show that in-scope devices, services and systems have been configured to remove unnecessary risk?

Your Workbook Activity

Complete: Final secure configuration review record

Next Lesson

In the next lesson: User access control: accounts, permissions and least privilege