An antivirus subscription renews and the invoice gets paid. That tells you the business has bought something. It doesn't tell you whether the spare laptop is protected, whether a setting was disabled or who reads the alerts.
For Cyber Essentials preparation, start with the devices and work towards the protection on each one. You want to be able to explain what is active, what it does and how somebody notices when it stops working.
The checks below are practical ways to investigate that. They aren't a replacement for the official assessment questions or a prescribed reporting format.
Choose the right protection route
The NCSC's current requirements offer anti-malware software for Windows and macOS devices, or application allow listing for any in-scope device. At least one applicable mechanism must be active and maintained. Buying a particular brand isn't required.
Anti-malware must stop malicious software and code running, block malicious websites and stay updated as the vendor recommends. Allow listing must restrict execution to actively approved, correctly signed applications and prevent installation of unsigned or invalidly signed apps.
Use those requirements when comparing settings. A list of recommended apps in a handbook doesn't demonstrate that an allow-listing arrangement actually restricts what can run.
Match the protection report to your device list
Ask your provider for the devices its security service currently sees. Compare that with the devices people actually use, including the one taken home by a director and the laptop reserved for temporary staff.
If a device is absent, find out why. Perhaps it was replaced and the equipment list needs updating. Perhaps the protection was never installed. Perhaps the device hasn't been online for weeks. Each explanation leads to different work.
Agree the names you use for devices. Matching a finance spreadsheet's serial number to a security console's friendly name can become a surprisingly long job. A common identifier helps avoid investigating the wrong laptop.
Keep missing results visible. An empty status field isn't evidence that everything is fine. Give somebody the task of getting a current result or resolving the discrepancy.
Look past the green tick
A summary indicator is useful, but ask what it measures. Does it mean the computer recently checked in, the software is installed, or that the required protections are working? Those aren't necessarily the same finding.
IASME's malware guidance highlights automatic file checks and protection against malicious web pages. For your chosen product, use the vendor's current instructions to find those settings and confirm how protection works with the browsers your staff use.
Ask your provider to show the last successful update and any warnings requiring action. Check whether a subscription or management connection has expired. If the product has exclusions, ask what each one allows and why it is still needed.
Exclusions deserve an explanation you can understand. For example, an exception created while troubleshooting one application shouldn't be left unexamined simply because nobody remembers the original ticket.
Give mobile devices their own check
A laptop security report won't necessarily describe what is happening on phones and tablets. Write down the relevant protection method for each device type instead of assuming one tool covers everything.
IASME's guidance discusses approved applications and trusted app sources for mobile devices. Ask how your arrangement controls installation, how applications are approved and how the current approved list is maintained.
Consider an imagined business that approves a scanner app for delivery receipts. The useful questions include who selected it, how it reaches employees' devices and what happens if someone installs a different scanner to get a job finished. An answer that only names an app store misses those practical details.
Where personal devices are involved, settle what your business can manage and how staff will follow the agreed arrangement. Our guide to cloud services and personal-device scope helps with the earlier question of which devices belong in the assessment.
Follow one alert through to a person
Ask who receives a protection warning and what they are expected to do. A shared mailbox nobody checks is a poor destination for a message that needs attention.
You can review this without downloading anything dangerous. Ask your provider to walk through an existing, suitably redacted alert or a vendor-approved demonstration. Who sees it first? Who contacts the user? Who decides whether the device needs further investigation? How is the outcome recorded?
Distinguish a blocked item from an unresolved incident. A message saying something was detected may need investigation to establish whether it ran, what was affected and whether more action is necessary. Let a competent responder interpret the evidence rather than guessing from a notification title.
Give staff a simple reporting route too. They should know where to send an unexpected warning and should feel able to report a mistake promptly.
Agree what happens when protection fails
Write a short procedure for devices that stop reporting, lose required settings or can't update. Include who investigates, who can make a repair and who decides whether business use should pause while the problem is resolved.
Choose a sensible review routine with your provider. Its frequency should reflect your working pattern and the tools available. This article doesn't prescribe a new Cyber Essentials interval.
Finish by checking one ordinary device together. Ask the provider to explain the result in terms of the actual requirements. You should leave with a clear answer about that device, a list of anything still unresolved and a named person responsible for each next step.