A new laptop isn't necessarily ready for work. It may come with trial applications, an account created during setup and settings intended for home use. A reused machine can have its own leftovers, such as an old support tool, a forgotten browser extension or a login nobody can explain.
Secure configuration means deciding what the device needs to do, setting it up for that job and checking it regularly. If you run a small business, a short handover routine that you can use for each device is a useful place to start.
Understand what the control covers
The current Cyber Essentials requirements cover accounts, default or guessable passwords, unnecessary software, unauthorised automatic execution, authentication and device locking. You need to manage these regularly. The control applies to other devices and cloud services as well as laptops.
IASME's secure configuration guidance explains why this matters. Unnecessary accounts and features give someone more ways to gain access. Removing them also leaves fewer things for you or your IT provider to look after.
The routine below is a suggested way to organise the work. It isn't an official build template. The settings you choose will depend on the product and what people need to do with it.
Describe the job before changing settings
Imagine a surveying business preparing a laptop for a new colleague. In this fictional example, the laptop needs office applications, a browser, a drawing viewer and an approved connection to the firm's file service. Write down that list before you start changing anything.
For each approved application, note what it's for, where you'll install it from, who maintains it and any settings the person's role requires. Keep a separate note for exceptions, such as a drawing package used by only one team.
The list gives IT and the manager something concrete to discuss. If nobody can explain why you need a trial application or an old remote-support tool, check whether you can remove it. First, find out whether anything else depends on it. An unfamiliar component might be keeping an important application working.
Ask the same questions about cloud-service settings. A trial integration or sample workspace can stay available long after the person who set it up has forgotten about it.
Check who can sign in
Go through the device's local accounts before handover. Which do you need? Who looks after them? Why does an account have administrator access? Follow the vendor's supported process to remove or disable unnecessary accounts, and replace any default or easily guessed passwords.
In the surveying example, a technician might have created a temporary account while installing software. Check whether it's still needed and what it can access. Don't assume the account disappeared when the technician signed out.
Record what you've checked, but keep passwords out of the handover document. If you need to retain credentials for support, store them using your organisation's approved method and controls. Then check that the person receiving the device can still do their normal work.
Agree who can install more software, too. People need to know how to request a new application and who will check it before installation.
Try the device lock yourself
For a device that someone physically unlocks, check what happens when it starts, wakes or is left unattended. Does it ask the user to prove their identity as intended? Test the controls on the device itself.
The NCSC makes a distinction between a credential used only to unlock a device and one also used to authenticate to services. The six-character minimum applies to the device-only credential. A credential also used for services must meet the full account-password requirements. You also need to consider the requirements for protection against repeated guessing. Check the relevant section and the vendor's instructions, because the same rules don't apply to every PIN and password.
As an extra practical step, agree how long a device can sit unused before it locks. Choose a setting that suits the workplace and check that it works. Describe the timeout as your organisation's choice. Don't present it as a fixed Cyber Essentials requirement.
If people share a workstation, ask each of them to try signing in and locking it. If the process is awkward or hard to remember, simplify it before handing over the machine.
Check automatic execution and unnecessary services
IASME explains why you need to check automatic execution from removable media. Under the current requirement, software shouldn't run through an autorun feature without the user's authorisation. Follow the documented steps to check the device's settings. You don't need to plug in an unknown USB device to test this.
Go through enabled services with someone who understands the system. Record why you need each one, and remove or disable anything unnecessary. Speak to whoever manages the firewall before making changes that affect network access. Our firewall questions guide covers that part of the assessment.
Run through a normal working session
Before handing over the surveying laptop, sign in, open the approved applications and check that you can reach the files you need. Lock it, then resume work. Check that support still works through the approved route. Record the device, date, settings checked and any unresolved issues. Give each remaining action to a named person.
Repeat the review when something significant changes. That might mean giving the device to a different person, changing support suppliers or introducing a new application. These are useful times to check the setup alongside your regular management routine.
A clear record helps the next person look after the device without guessing why you chose a setting. When you prepare your assessment answers, use the live IASME question preview. Describe the setup you've checked on the device.