Questions | Readiness

CYBER ESSENTIALS QUESTIONS

Step 1 of 12 - An Introduction to Cyber Essentials Questions

These questions are designed to help you think about cyber security within your organisation. Each question will prompt you to consider a different aspect of security which will protect your organisation against threats from the internet.
Whilst the results are stored, there is nothing associated with the results that will identify you.
If you want to pause the questions part way through and return to them later, there is a save and return button. If you click on save and return, you will be taken to a page with a link. Keep this link somewhere safe and do not share it with anyone. This is the equivalent of your password, for when you come back to these questions.
These questions do not form a pass or fail test. Instead, your responses will help inform a personal action plan that will help you move towards meeting the Cyber Essentials requirements. The action plan includes links to specific guidance on how to do that.
Are you part of the Funded Cyber Essentials Programme?*
For information on Funded Cyber Essentials Programme, please click here.
Are you an education provider?*
Before we get going with the assessment, please select the business that best describes your sector from the drop down list. Once you select your business sector, the next button will appear*
Please describe your sector
What is the size of your academic establishment ?*
A guidance document has been developed providing more information on how to judge the the size of your school. This can be seen here
What is the size of your organisation?
How many staff are home workers ?*
Have you held certification before ?*
Address*
County

Your readiness action plan
Scope of your evaluation

The scope of the CYBER ESSENTIALS (CE) assessment includes the IT infrastructure used to perform your business. This will include all devices that access organisational data and services (including emails), and all cloud services that host organisational data and services.

The preferred answer is for your scope to be “whole organisation” because this gives you the most protection. It will also mean that you qualify for the included cyber liability insurance (if your annual turnover is less than £20 million and you are domiciled in the UK).

In some cases, however, it is not possible to have the whole organisation in scope, for example, if you want to use software that is no longer supported. In this case, you must have a way to separate what is in scope from what is not (e.g. a firewall or a VLAN), and you must be able to clearly describe what the scope is (e.g. our office in Guildford only).

If you have IT equipment that does not ever connect to the internet and does not control data flow to and from the internet, then this is automatically excluded from the scope of CE, and you do not need to declare it.
Please note that if you are a sole trader, your organisation may simply include yourself, your mobile phone and the tools of your trade.
Would this assessment cover the whole of your organisation ?*
Is it possible to apply controls to a subset of your organisation ?

Action item
	Can you include the whole of your organisation in the scope of the assessment? If this is not possible, can you implement controls on just part of your organisation that would keep it secure and separate from the rest of the organisation? You may need professional advice on how to achieve this.
	Do you need more information or guidance about scope? Find out more about scope of evaluation in our guidance information.
	Do you need more information or guidance about scope? Find out more about scope for schools in our guidance information.

Does the scope of your evaluation include end user devices? ( e.g pcs, laptops, tablets and mobile devices that have interfaces used by people)
Action item

Cyber Essentials must include end point devices.

Save and continue later

Hardware or devices used by your organisation

Hardware and devices are the physical pieces of electronic equipment your organisation owns such as computers, servers, laptops, thin clients, printers, tablets and mobile phones.

As well as knowing what physical parts of your organisation are in scope, it is also necessary to know which of your devices or networks (internet connected computers) are in scope.

An important first step is knowing what devices your organisation uses. This section talks about your understanding of what devices you have, where they are, and whether they are supported, maintained, patched and secure.

In addition to having financial worth, devices also hold information, which is valuable to both you and your students. This might be about your students, information about your school, or emails containing private or confidential information. You can protect your information by ensuring your devices are updated with the latest software, putting access controls in place, using controls to restrict the flow of malware and where appropriate, ensuring that the file system is encrypted (To encrypt files means to turn the information into a code so that unauthorised people cannot read them even if they do intercept them).

So now, in terms of office devices, mobile devices and networking devices, can you list the hardware assets used by your organisation?
Hardware or devices used by your organisation

Hardware and devices are the physical pieces of electronic equipment your organisation owns such as computers, servers, laptops, thin clients, printers, tablets and mobile phones.

As well as knowing what physical parts of your organisation are in scope, it is also necessary to know which of your devices or networks (internet connected computers) are in scope.

An important first step is knowing what devices your organisation uses. This section talks about your understanding of what devices you have, where they are, and whether they are supported, maintained, patched and secure.

In addition to having financial worth, devices also hold information, which is valuable to both you and your customers. This might be about your customers, information about your organisation, or emails containing private or confidential information. You can protect your information by ensuring your devices are updated with the latest software, putting access controls in place, using controls to restrict the flow of malware and where appropriate, ensuring that the file system is encrypted (To encrypt files means to turn the information into a code so that unauthorised people cannot read them even if they do intercept them).
Do you have an asset register ?*
Action item

Do you need more information or guidance about asset registers? Find out more about asset management in our guidance information.
Does your asset register include a list of all hardware devices that you use? For instance types of laptops, smart phones, firewalls, routers ?*

Action item

Asset management is highly recommended as a core security function in Cyber Essentials. Making and maintaining a list of all devices that are held in your organisation is a practical first step that will assist with other important requirements. When you start to make the list, you might need to talk to staff, check purchase requests and receipts and work through each office in a detailed way. It is important to know about every device that holds information which you wouldn't want to be lost.

Do you use thin clients?*
Action item

Do you need more information or guidance about thin clients? Find out more about thin clients in our guidance information.
Action item

These need to be listed with your other hardware devices
Do you own or rent servers ?*

Action item

If you are subscribing to Infrastructure as a Service from a cloud service provider, eg Microsoft's Azure Virtual Desktop or Citrix managed desktops, you will be responsible for applying the Cyber Essentials controls to the virtual environment that you configure and use. That will include virtual desktops, virtual local area network (VLANS) including virtual firewalls, virtual switches etc.

If you own or rent the servers which are housed on site or within a data centre, and you configure the hypervisor software to create virtual machines, you will need to apply the Cyber Essentials controls to the servers and hypervisors. This means you need to keep the hardware and software licenced, updated and patched.

Action item

Do you need more information or guidance about virtual servers? Find out more about virtual servers in our guidance information.
Action item

All servers including virtual servers need to be listed with your other hardware devices.

Save and continue later

Software and firmware used by your organisation

If hardware is the physical part of a device, software is the operating system, programs and applications that give the instructions. Firmware is a specific type of software that allows certain pieces of hardware to do what they were designed to do. Firewall and router firmware is particularly important in Cyber Essentials as it serves as the operating system of those devices. As firewalls and routers are key security devices, their operating systems and whether they are kept up to date is extremely important from a security perspective.

Knowing which software and firmware you have and whether they are supported is really important. Software and firmware are supported by the manufacturer for a period of time after they have been developed. This support means that if a mistake or weakness, known as a vulnerability, is discovered in the product, the manufacturer will address it with an update or patch which fixes the problem before it can be exploited by cyber criminals.

A list of software / firmware is sometimes referred to as a software asset list (or inventory). It's good to have a clear picture of what software you have, whether you have got the correct amount of licenses, and whether it is in support (patches are available to fix software vulnerabilities).
Do you have a list of all software / firmware used on devices within your organisation ?*

Action item
	As part of your asset register, create a list of all software / firmware used within your organisation. This might be firmware found on your router or firewall, it may be the versions of operating system, ( e.g.Windows or MacOS), browser platforms, (e.g.Adobe Flash) or it may be your suite of office tools, (e.g.Microsoft Word, Drop box, Hootsuite)

Virtualisation is a technology that allows the hardware of a server to be used to create software-based or ‘virtual’ versions of computers known as virtual machines.

Virtualisation is made possible with a type of software called a hypervisor.

Cloud services are based on the technology of virtualisation. In addition, many organisations use virtualisation to maximize the use of their servers which may be located on site or within data centres.
Do you have any virtualisation infrastructure within your organisation?*

Action item

If you are subscribing to Infrastructure as a Service (IaaS) from a cloud service provider, eg Microsoft's Azure Virtual Desktop or Citrix managed desktops, you will be responsible for applying the Cyber Essentials controls to the virtual environment that you configure and use. That will include virtual desktops, virtual local area network (VLANS) including virtual firewalls, virtual switches etc.

Action item

Do you need more information or guidance about virtualisation? Find out more about virtualisation in our guidance information.
Is your hypervisor software supported and receiving security updates?

Action item
	If you own or rent servers which are housed on site or within a data centre, and you configure the hypervisor software to create virtual machines, you will need to apply the Cyber Essentials controls to the servers and hypervisors. A hypervisor is software and this means you need to keep it licenced, updated and patched.

Do you have automatic update enabled on all your software?*

Action item

The easiest and most effective way to ensure that all your software is kept up to date is to turn on automatic updates on each of your devices. This will mean that patches are automatically applied when they are released by the respective vendor. Many devices now have automatic update turned on by default.

You can check that automatic updates are turned on in settings, under update and security, or systems preferences, under software updates.

If not, do you have a process for applying all high and critical updates within 14 days?

Action item
	For some larger organisations, there is a concern that some software updates may stop other software from working or cause some features to break. Most IT teams in larger organisations aim to fully test each update on a controlled sample of devices, before applying it company wide. The National Cyber Security Centre has some useful guidance on installing software updates without breaking things

Do you use software that is no longer in support?

Action item

Think about going through all the software / firmware used within your organisation and ensuring that it is all in support. This might seem like a lot of work, however, in many ransomware attacks out of support software is deliberately targeted by attackers as they know which vulnerabilities are there, and that they will not be fixed. By completing this piece of work, you can look at what software or firmware is not supported and create an action plan to either get software / firmware back into support or update to a more recent supported version.

Action item

Within a piece of software's functioning life span, as soon as an error or 'vulnerability' is discovered, the manufacturer creates some additional code to correct and close the opening. This is known as 'patching'. All modern software will need to 'update' on a regular basis as part of its maintenance which ensures that vulnerabilities are patched within 14 days of the update, and other 'bugs' (faults) corrected. When software that is considered 'end of life' or no longer viable with modern technology, the manufacturer will cease to create patches and updates. This means application becomes a 'legacy software' and is no longer supported or 'unsupported', and therefore no longer secure. Not only are the vulnerabilities left un-patched, but they become common knowledge for hackers, and therefore easy to exploit. You can find out if your software is still ' in support' by checking the vendor website and support pages. You could also look for this information by conducting an internet search against the vendor name, product and using the term ‘end of life’ or ‘support cycle’.

Have devices that are using unsupported software been moved to a segregated sub-set and internet access removed?

Action item
	If you need to use old, out of support software for a particular project, you must have a way to securely separate this part of the business from the rest of your business. One solution would be to use a technical configuration on a firewall or VLAN to segment any unsupported software or devices from accessing the internet. This would protect the 'in scope' business network from any vulnerabilities introduced by the unsupported software. A sub-set is a name given to the network segment which is technically separated by a firewall or VLAN.
	Do you need more information or guidance about software ? Find out more information about software in our guidance information.

Save and continue later

Firewalls

Boundary devices are the devices found on the edge of your network. Examples of boundary devices include an office firewall or a broadband router.

Most routers supplied by your Internet Service Provider (ISP) have a firewall built in. Common internet routers are BT Home Hub, Virgin Media Hub or Sky Hub.

Your organisation may also have set up a separate hardware firewall device between your network and the internet. Firewalls are powerful devices, but to be effective they need to be correctly configured.

Smart phones do not come with firewalls as default. A firewall is not necessary on your mobile phone as long as you only allow trusted apps from reputable sources.
Do you have a firewall (or router with a firewall) between your business network and the internet ?*

Action item
	Find out whether you have a router or firewall between you and the internet. If you don’t have any protection between your network and the internet, it might be worth investigating this further. No protection is the equivalent of permanently leaving your front door unlocked.
	Do you need more information or guidance about firewalls or routers ? Find out more information about firewalls or about routers in our guidance information.

On your firewalls and internet gateways - have you changed all the passwords away from the default passwords and are they difficult to guess and more than 8 characters ?*

Action item
	Look at changing your password to something unique and complex. There is plenty of advice on the National Cyber Security Centre website about how to select a good password that is easy to remember.
	Do you need more information or guidance about passwords. Find out more with the guide to password creation here.

If you thought the passwords were known (someone left and knew the password or something happened like the same password used elsewhere was discovered) would you know when and how to change it ?

Action item
	Look at having a simple process in place for changing passwords when they are known by people who shouldn't. This might not be an attacker, it could equally be someone who has left the company and has no need for access any more. .
	Do you need more information or guidance about passwords. Find out more information about password creation here.

Save and continue later

Accessible services from the internet

Your organisation’s devices will connect to the outside, wider internet through a gateway. A gateway in a network has the same job as a gateway in a field. It is there to keep some things in, keep some things out and allow specific things to pass through.

It is important that your gateway doesn’t have holes which could allow things to pass through that you don’t want. Your firewall protects this gateway.

At times your firewall may be configured to open a hole and allow a system on the inside of your network to become accessible from the wider internet (such as a Virtual Private Network server, a mail server or a service that is accessed by your customers). This is sometimes referred to as "opening a port". There are many reasons why you would want to do this and it is possible to do in a secure way, however, there needs to be a valid business requirement to open a port. If this has not been a considered and deliberate decision, it could present a risk to your organisation and the safety of it’s information.

Ensure that there are mechanisms in place to permit only the people who need to access your configuration. For example, the firewall or router might be configured to allow access to an external IP address or range that only your supplier uses, or it might be configured to use two factor authentication. Check with someone in your organisation about whether this applies.
Do you have services enabled that are accessible externally ?*

Action item

Always review what services from within your network you expose to the outside world, and how many people you are allowing to use that service.

A ’bot’ is a software application that runs automated tasks over the internet. Criminals use this tool to scan the internet for open ports and services that are available for use and could be exploited. If there was a vulnerability or misconfiguration, they would know before you. Always review whether you have a requirement for an open port, and if you do, can you configure this to as few people as possible? Make sure that you can continually update those services exposed to the outside world. If you are unsure about this, seek guidance from a professional who can perform a security scan against your network.

Do you need more information or guidance about firewalls ? Find out more information about firewalls in our guidance.

Can you configure your internet routers or hardware firewalls over the internet ? This might be in place if you have a third party IT company managing those devices on your behalf.

Action item
	Ensure that your gateway or firewall configuration is set to ensure that only services with a valid business need are exposed. Any services that are not required to be exposed to the internet should be blocked. You may need to seek help to check this.
	Do you need more information or guidance about firewalls ? Find out more information about firewalls in our guidance.

Have you configured your internet routers or your hardware firewalls to block all other services being advertised to the internet ?

Action item
	Get someone to review your gateway or firewall configuration to ensure that only services with a valid business need are exposed. Any services that are not required to be exposed to the internet, should be blocked.
	Do you need more information or guidance about firewalls ? Find out more information about firewalls in our guidance.

Save and continue later

Cloud services

Different components of computing are available to users within an organisation remotely over the internet and payable on demand or by subscription. Cloud services is the collective name for these externally manged services. Examples are: Microsoft 365, Dropbox, Googledrive, AWS and Citrix Workspace.

Most organisations use a great many cloud services, it allows for a flexible and collaborative use of a resource without having to make the large outlay for ever changing technology. Cloud computing has revolutionised working models by allowing workers to access and share company information from any location and deliver services online. If workers can access organisation information over the internet from any location, so can criminals, and this has resulted in an increasing number of attacks on cloud services, using techniques to steal user's passwords to access their accounts.

It is crucial that organisations understand their role and responsibilities in the security of the cloud services they use. The five core controls of Cyber Essentials apply to all cloud services.
Do you have a list of all the cloud services you use in your organisation?*

Action item

As part of your asset register, create a list of all the cloud services used within your organisation.

This might be Software as a Service ( SaaS) for everyday tasks such as creating and sharing files, signing and sending contracts and project management. Examples are: Microsoft 365, Jira, Dropbox, Adobe Sign, Gmail.

Platform as a Service (PaaS) which would offer your organisation a platform for software development and deployment over the internet, enabling you to access up-to-date tools. Examples include Azure Web Apps and Amazon Web Services Lambda.

Infrastructure as a Service (IaaS) provides infrastructure components (servers, storage, networking hardware) that typically exist in an on-premises data centre. This can offer solutions for program development and testing, disaster recovery and backing up, hosting complex websites, high computing performance and big data analysis. Examples include Rackspace, Google Compute Engine, or Amazon EC2.

Action item

Do you need more information or guidance about the cloud ? Find out more information about the cloud in our guidance information.
Have you enabled MFA on all accounts to access all the cloud services that you use?*
Action item

Do you need more information or guidance about the 2 Factor Authentication ? Find out more information about 2 Factor Authentication in our guidance information.

Action item

As well as providing extra protection for passwords that are not protected by other technical controls, multi-factor authentication should always be used to provide additional protection to administrative accounts and user accounts that are accessible from the internet. No matter how an attacker acquires a password, if multi factor authentication is enabled, it will act as a safeguard on the account.

When you are setting up your cloud service account, you will be asked to set a password, this must have at least 8 or more characters. You must also enable MFA on your account, this means that in addition to the password, account holders will be asked to prove their identity with one or more other ways. This could be through a code sent to another device such as a text message to a mobile phone or a single use code generated by an authenticator app or physical token. There are four types of additional factor that may be considered for businesses:

A managed/enterprise device
An app on a trusted device
A physically separate token
A known or trusted account

Additional factors should be chosen so that they are usable and accessible. This may require user testing to verify if a factor is suitable for the users. For more information see NCSC's guidance on MFA

Action item

If it is not available - which cloud service does this apply to?
Have you located and understood the ‘shared responsibility’ security arrangement for each of the cloud services you use?*

Action item

In its simplest terms, a shared responsibility model denotes that providers are responsible for the physical security and hardware infrastructure of the cloud service and customers are responsible for securing the data they put in the cloud. Depending on the type of deployment—IaaS, PaaS, or SaaS—customer responsibilities will be different.

The major cloud service providers publish 'Shared responsibility models' such as Microsoft, Amazon Web services (AWS). The less well-known cloud service providers may not have a published model, in this instance check the contract in place with the provider or contact them directly to discuss. It is important for you to know what aspects of security you are responsible for and what aspects the provider has in place.

Save and continue later

Secure configurations

When computers are first set up, they frequently prioritise user ease rather than security.

A typical ‘out-of-the-box’ set-up might enable an administrative account with a standard, publicly known default password. There is often one or more additional user accounts enabled (sometimes with special access privileges) and pre-installed but unnecessary applications or services, sometimes, even a default file share. All of these present security risks. Like setting sail in a leaky boat, it’s wise to make sure your system is water-tight before you go any further.
Have you been through the devices that you have and disabled or removed the software that you dont use ?*

Action item

Review your devices with a view to removing services, software or applications that are not required.

This might include a server running a default web server that you don’t use, additional accounts on some devices that are not required, or any additional software that you don’t use.

Do you need more information or guidance about removing unnecessary software ? Find out more information about removing unnecessary software in our guidance.

Have you ensured that all the accounts on your devices and cloud services are only those that are used as part of your day to day business ?*

Action item
	Look to review each of the user accounts on your devices and cloud services.
	Do you need more information or guidance about removing unnecessary software? Find out more information about removing unnecessary software in our guidance.
	Do you need more information or guidance about user account accounts ? Find out more information about accounts in our guidance.

Is "AutoRun" or "AutoPlay" disabled on all of your devices?

Action item
	Auto-Run or Auto-Play is a setting that automatically runs software on a DVD or memory stick. It is important to disable Auto-Run or Auto-Play in order to avoid automatic installations of unauthorised software. When Auto-Run or Auto-Play is disabled, the user is prompted to give permission every time before software is allowed to run or play.
	Do you need more information or guidance about removing software ? Find out more information about removing unnecessary software in our guidance.

For mobile devices, do you set a locking mechanism on your devices to access the software and services installed? This might be a pin number, a password, face-scan or fingerprint.*

Action item
	By setting a unique 6 character or more password or pin number, or a biometric method to unlock your devices, you can stop unauthorised people accessing your information if the device is lost, stolen or left unattended.

Save and continue later

Use of Passwords

We need our passwords to be secure so that people cannot guess them to get onto our system.

This section is all about passwords and includes ideas to help ensure that everyone, on every device, employs good password security.
Do you ensure that all default passwords on all devices are changed ?*

Action item
	A default password is a standard pre-configured password allocated to a device by the manufacturer for its initial set up. It is not difficult to find out the default passwords for many devices with a simple internet search. Attackers will use a default username and password combination and try to connect to one of your devices, even though it is within your internal network. Simply by changing the default password (and username if possible) you have immediately made a hacker’s job much harder.
	Do you need more information or guidance about passwords? Find out about password creation here.

Does your password policy include advising all users how important it is to use different passwords for different systems?

Action item
	Do you have a username and favourite password combination that you tend to use on most of your accounts to make life easier? If just one of your accounts becomes compromised (and you might never know) your username/ password combination can be stolen. Attackers have lists of compromised username/passwords combinations and this enables them to try and access any account where that combination works. If you use different passwords for different systems, one compromised password does not mean that attackers can then get onto all your systems.
	Do you need more information or guidance about user account accounts ? Find out about accounts in our guidance.

Do you make sure that each user requires their own username and password and there are no shared username / passwords?**

Action item
	Sharing usernames and passwords is not a good idea. If one of the users did something which was not allowed, it would not be possible to determine who it was or even if it was an authorised user. When organisations want to share user accounts the software or the processes can be changed to achieve the same result safely without actually sharing accounts. This makes the organisation more secure.
	Do you need more information or guidance about user account accounts ? Find out about accounts in our guidance.

Do you provide guidance on how to create good passwords within your organisation? Do you specify the technical controls to manage the quality of passwords used? Do you have a process for when you believe that a password or an account has been compromised?

Action item

A password policy must detail the process for creating passwords for all work accounts. A password for a work account must include one of the following:

Using multi-factor authentication
A minimum password length of at least 12 characters, with no maximum length restrictions
A minimum password length of at least 8 characters, with no maximum length restrictions and use automatic blocking of common passwords using a *deny list.

*An automatic deny list will block users from using passwords that are on a pre-configured list of common passwords that have been breached. Organisations can create a deny list from a file of the 100,000 most commonly breached passwords compiled by the NCSC.

There is an established process to change passwords promptly if the applicant knows or suspects the password or account has been compromised.

Do you need more information or guidance about the value of passwords? Find out more about passwords here.

• Is your antivirus software set up to update daily and scan files automatically ?*
Is there support in place to help employees choose unique passwords for their work accounts?*

Action item
	The following ways can help your employees create more secure passwords: Educating people on how to avoid common or discoverable passwords, such as a pet's name, common keyboard patterns or passwords they have used elsewhere. This could include teaching people to use the password generator feature built into some password managers. Encouraging people to choose longer passwords. This can be done by promoting the use of multiple words (a minimum of three) to create a password, (e.g., 'Three Random Words') Providing usable secure storage for passwords (for example a password manager or secure locked cabinet) with clear information about how and when it can be used. Not enforcing regular password expiry Not enforcing password complexity requirements
Action item
	How to create passwords using three random words How to use a random generated password from a password manager

Have you put measures in place to protect accounts against brute-force password guessing?*

Action item

Brute force attacks use computers to target a login page where they try many different combinations of characters until the correct combination is found to crack the password. Depending on the length and complexity of the password, cracking it can take anywhere from a few seconds to many years.

Using a long password is a good way to protect your data from a brute-force attack. A password that is created by a password manager or three random words can be used to achieve this.

By implementing at least one of the following measures can help protect your passwords against brute-force password guessing:

Using multi-factor authentication
'Throttling' the rate of attempts. This means the time the user must wait between attempts increases with each unsuccessful attempt. This should permit no more than 10 guesses in 5 minutes.
Locking accounts after no more than 10 unsuccessful attempts

Save and continue later

Protection against malware

Malware is a shortened form of malicious software. This is software that is designed to steal information, to damage information or to prevent you from delivering information.

One of the ways of protecting your devices and network against malware is to keep your software up-to-date with the latest software patches. An additional method is to ensure that you have malware protection software installed and updating. Antivirus is a commonly used term for this type of software and usually combats many types of malware.
• Are all of your computers, your laptops, and your mobile phones protected against malware by using one of these options? (Select the ones that apply.)
- I have malware protection software installed
- I limit installation of applications to an approved set
- None of these apply

Action item
	Have a look through the options for your malware protection software which needs to be set up and configured in line with vendors best practise. Additionally, try and use on-demand file scanning, so all files are scanned before being loaded by applications or the operating system.
	Do you need more information or guidance about malware ? Find out more information about malware in our guidance.

Action item

You can largely avoid the potential for harm from malware by:

Detecting and disabling malware before it causes harm (malware protection software)
Executing only software that you know to be worthy of trust (allow listing)

You must ensure that each of your devices uses at least one of these methods to protect it from malware.

Do you need more information or guidance about malware ? Find out more information about malware in our guidance.

• Have you a solution in place (this might be part of your antivirus software) to check web pages when you view them for malicious content?*

Action item
	Have a look through the options for your AV solution see whether this also protects you whilst browsing on the web.
	Do you need more information or guidance about malware ? Find out more information about malware in our guidance.

Where you use an app store, are users prevented from installing unsigned applications*

Action item
	Consider allowing users to only install applications that have been checked by yourselves and also where they have been signed. Code signing (in many of the play stores) means an element of checking has taken place prior to the applications being released. You might also consider only allowing users to install applications with a business requirement. Some applications might create risks that are inconsistent with your risk tolerance. You could review each of the applications and then approve only the ones which complied with your, or your customers rules,
	Do you need more information or guidance about malware ? Find out about malware in our guidance.

Save and continue later

User accounts

The final part of this assessment is all about how you set up and manage both the user and the administrator accounts.
Is there a process you follow in order to create a new user account?*

Action item
	Consider whether a user account creation process would help your organisation. It might be that only once someone has signed their paperwork and received clearance (if appropriate) they are issued with a computer user account.
	Do you need more information or guidance about user account accounts ? Find out about accounts in our guidance.

Have you a process for tracking user accounts of people who join or leave ? Please note that you need to be able to show that you have considered this process for potential new staff even if you are a one person organisation.*

Action item
	Consider whether you could develop a movers, leavers or joiners process. When someone joins your organisation, their account permissions are recorded and approved. When they leave, their account is disabled (or removed).
	Do you need more information or guidance about user account accounts ? Find out about accounts in our guidance.

Is there a process that is followed before a member of staff is given an administrator account?

Action item

Consider whether a user account creation process would help your organisation. It might be that only once someone has signed their paperwork and received clearance (if appropriate) they are issued with a computer user account.

Consider whether you could create a set of rules around administrator accounts. You would need to clarify who has the administrator accounts and ensure that these accounts were not used for emails and web browsing. Regular account activity is risky on an administrator account as any compromise can happen with a higher set of permissions, meaning there is potential for greater harm to your system.

Do you need more information or guidance about user account accounts ? Find out about accounts in our guidance.

Do you have a process for ensuring that employees do not use administrator accounts for day to day activities such as browsing the internet and checking emails?

Action item
	Staff should have separate user accounts if they are expected to perform both administrative and routine functions and they should log in with their standard user accounts for day-to-day tasks. Administrator accounts should be used only to install or modify software and to change system settings. It is often necessary to use a combination of policy and staff training to achieve this requirement.

Save and continue later

Backing Up Data

A Cyber Essentials Recommendation
Do you have a system for backing up your organisational data?

Action item

Data backup is not included as a mandatory requirement in Cyber Essentials because it is not a defensive control (Cyber Essentials focuses on defensive technical controls). However, despite the best cyber security efforts, there is no such thing as a completely secure system and all organisations are at risk of a cyber-attack, accidental damage or a natural disaster. Backing up your data means creating a copy of your information and saving it to another device or to cloud storage (online). It is recommended that you back up your files regularly and check that your back-ups work. This will help you recover more quickly if your data is lost or stolen.

Next steps
For further help and guidance about Cyber Essentials:

Look through our frequently asked questions available on our website.

Join the free Cyber Essentials LinkedIn advice group here

The Cyber Essentials certification bodies who are located all around the UK and Crown Dependencies are available to offer consulting services to help you achieve your certification.

If you are ready to certify to Cyber Essentials, you can see all the Cyber Essentials assessment questions from https://iasme.co.uk/cyber-essentials/free-download-of-cyber-essentials-self-assessment-questions/.

You can apply for a Cyber Essentials assessment via the website here. The Cyber Essentials prices can be seen below:.

The benefits of certification

Cyber Essentials can help your organisation in many ways:
- Have the peace of mind that you have implemented the core controls that help prevent most cyber attacks.
- Reassure customers or stake holders that you take cyber security seriously.
- Attract new business and contracts or additional funding and grants that stipulate Cyber Essentials as a prerequisite.
- Be listed on our directory of organisations awarded Cyber Essentials
Readiness tool feedback

We hope you have found this advice tool helpful. We would welcome any feedback to help us improve this tool. To take a short survey please click here.

Save and continue later

Additional guidance

No additional guidance

CYBER ESSENTIALS QUESTIONS

Step 1 of 12 - An Introduction to Cyber Essentials Questions

Your readiness action plan

Scope of your evaluation

Action item

Action item

Hardware or devices used by your organisation

Hardware or devices used by your organisation

Action item

Action item

Action item

Action item

Action item

Action item

Action item

Software and firmware used by your organisation

Action item

Action item

Action item

Action item

Action item

Action item

Action item

Action item

Action item

Firewalls

Action item

Action item

Action item

Accessible services from the internet

Action item

Action item

Action item

Cloud services

Action item

Action item

Action item

Action item

Action item

Action item

Secure configurations

Action item

Action item

Action item

Action item

Use of Passwords

Action item

Action item

Action item

Action item

Action item

Action item

Action item

Protection against malware

Action item

Action item

Action item

Action item

User accounts

Action item

Action item

Action item

Action item

Backing Up Data

A Cyber Essentials Recommendation

Action item

For further help and guidance about Cyber Essentials:

The benefits of certification

Readiness tool feedback

Additional guidance