The Short Version
- Cyber Essentials and most client audits test five controls: firewalls, secure configuration, user access, malware protection, and patch management
- Unpatched devices and stale user accounts fail most businesses before the assessment even begins
- Standard users should not hold local administrator rights on their own machines
- Most businesses reach audit-readiness within 30 days with the right preparation plan
A security audit is not a test you pass by reading about it the night before. Most businesses that fail do so on controls they already assumed they had: software they thought patched automatically, user accounts for staff who left two years ago, and a firewall nobody had logged into since the IT company that configured it was replaced.
The gap between believing your security is in order and confirming it is often wider than it looks. An audit forces that gap open. This guide walks through the five areas every assessor examines, what they look for in each, and the steps to take in the 30 days before your assessment date.
What Auditors Actually Check
Cyber Essentials, the UK government-backed certification scheme, defines five technical controls. Most client security questionnaires, cyber insurance assessments, and third-party audits cover the same territory with slight variations in depth.
- Firewalls. A boundary firewall between your network and the internet, with only the ports your business genuinely needs open.
- Secure configuration. Default passwords changed, unnecessary features disabled, full-disk encryption enabled on devices that leave the office.
- User access control. Accounts limited to what each person needs, admin rights restricted, stale accounts removed.
- Malware protection. Anti-malware software active and up to date on all in-scope devices.
- Patch management. Security patches applied to all software and firmware within 14 days of release.
Cyber Essentials Plus adds hands-on verification: an assessor connects to your network and tests devices directly rather than relying on your self-assessment responses. The controls tested are the same; the evidence standard is higher.
The five controls exist because the UK National Cyber Security Centre found that implementing them correctly prevents around 80% of the most common cyber attacks. An assessor is not looking for perfection across your entire IT estate. They are confirming that the five foundations are in place and working.
Patch Management: Check the Logs, Not the Settings
Cyber Essentials requires all software and firmware on in-scope devices to receive security patches within 14 days of their release. Software that reaches end-of-life and no longer receives patches must be removed from scope or segregated from the internet-connected network before the assessment date.
What needs patching
The scope covers every device that connects to the internet or to your internal network: Windows and macOS workstations, laptops, servers, smartphones and tablets on corporate accounts, network switches and routers, printers and NAS devices, VPN clients, browsers, and applications including Microsoft 365 desktop apps. If it connects to your network, it falls within scope.
Auto-update is not the same as up-to-date
The most common preparation failure: a manager confirms that auto-update is enabled on all machines, the assessor checks patch history, and finds devices 60 to 90 days behind on security updates. Auto-update settings require a restart to apply patches. Machines left in sleep mode for weeks, or users who dismiss restart prompts, accumulate a backlog of unapplied updates. Confirm patch status by checking the Windows Update history directly on each machine, not by verifying the setting.
Network equipment firmware
Routers, switches, and firewalls carry firmware that receives security patches. Most businesses never update this after installation. Log into your firewall and router admin panels, check the current firmware version, and compare it against the manufacturer’s release page. Cisco, Fortinet, Ubiquiti, and most business-grade vendors publish patch notes with CVE references that assessors can cross-reference.
User Accounts and Admin Rights
User account hygiene fails more Cyber Essentials assessments than any other control. The two most common problems are accounts for departed staff that remain active, and standard users who hold local administrator rights on their own machines.
Remove stale accounts
Pull a full list of active accounts from your Microsoft 365 admin centre or Active Directory. Cross-reference against your current headcount. Any account for a person who has left the business is a live credential with a password you do not know, on a system you no longer control. Disable rather than delete accounts initially, in case data recovery is needed, but disable them the same day you confirm the account is orphaned.
Remove local admin rights from standard users
A standard user with local administrator rights on their workstation can install software, disable security tools, and make system configuration changes. Cyber Essentials requires that standard accounts have only the permissions needed for their role. Remove local admin rights from all standard users. IT administrators need a separate administrator account for admin tasks, which they use in addition to their regular account. The regular account runs without elevated privileges day-to-day.
Multi-factor authentication
Enable MFA on every service accessible from the internet: Microsoft 365, Google Workspace, your VPN, cloud file storage, and any remote management tools. Cyber Essentials does not currently mandate MFA as a control, but most insurance assessors and client questionnaires do. An account without MFA that holds a compromised password gives an attacker direct access with no further barrier. Enabling MFA in Microsoft 365 takes under ten minutes in the admin centre and blocks the vast majority of credential-stuffing attacks.
Service accounts present a specific risk. An account used to run a backup job, a monitoring agent, or a scheduled task often holds elevated rights, rarely gets audited, and sometimes shares a password set years ago by a contractor who no longer works for the business. Audit every service account: confirm what it does, whether it still needs to exist, and when its password was last changed.
Network Boundary Controls
Your network boundary is the point where your internal systems meet the internet. Cyber Essentials requires a firewall at that boundary, configured to block inbound connections except those your business deliberately permits.
Consumer routers do not qualify
A consumer-grade router from a home broadband package does not meet Cyber Essentials requirements. Business-grade firewalls (Fortinet FortiGate, Cisco Meraki, WatchGuard, pfSense on appropriate hardware) provide stateful packet inspection, application-layer filtering, and audit logs that assessors can review. If your network boundary device is a consumer router or an ISP-supplied home hub, replace it before the assessment.
Close unused inbound ports
Log into your firewall and review the inbound rules. Every open port is an attack surface. Common ports to audit: RDP (3389) directly exposed to the internet is a critical finding and must be closed; FTP (21) should not be used; Telnet (23) must be closed; SMB (445) must not be open externally. Remote access to internal systems must route through a VPN with MFA, not through direct port exposures.
Separate guest WiFi
Your staff network and guest WiFi must be on separate VLANs with a firewall rule preventing lateral movement between them. A guest or contractor on your WiFi network should have internet access only. They should not reach internal file shares, printers, servers, or management interfaces. Most business-grade WiFi controllers configure this in a single setting; consumer access points vary.
Secure Configuration
Secure configuration means removing unnecessary features, changing default credentials, and ensuring devices operate with the minimum functionality needed for their role.
Change all default passwords
Every device that ships with a default password or default credential needs that credential changed before it enters your network: routers, switches, firewalls, printers, NAS devices, IP cameras, and access control panels. Assessors check this. Manufacturers publish default credentials publicly; an attacker can enumerate devices on your network and attempt the factory default within seconds.
Disable unused services
SMBv1 (the protocol exploited in the WannaCry attack) should be disabled on all Windows machines. Telnet should be disabled on all network devices. Remote Desktop should be disabled on machines where it serves no operational purpose. Review the services list on each server and disable anything that is not in active use.
Full-disk encryption
Every laptop and mobile device that leaves the office must have full-disk encryption enabled. BitLocker on Windows, FileVault on macOS. A lost or stolen laptop without encryption gives whoever finds it access to everything on the drive. With encryption enabled, the drive is unreadable without the authentication credential. Confirm encryption status in your MDM (Mobile Device Management) platform or directly on each device.
- Check Windows Update history on every workstation and server — confirm patches applied within 14 days
- Update firewall, router, and switch firmware to current release
- Pull the full user account list and remove or disable accounts for departed staff
- Remove local administrator rights from standard user accounts
- Enable MFA on Microsoft 365, Google Workspace, and VPN
- Review firewall inbound rules and close unused ports (especially RDP/3389)
- Confirm guest WiFi is on a separate VLAN with no internal network access
- Change default passwords on all network devices, printers, and cameras
- Confirm BitLocker or FileVault encryption active on all laptops
- Confirm anti-malware is active and definitions current on all in-scope devices
- Disable SMBv1 on all Windows machines and Telnet on all network devices
- Identify any end-of-life software and either update or remove it from scope
Frequently Asked Questions
Book a Free Cyber Security Consultation
Tell us about your IT setup and your audit timeline. We will assess your current position against the five Cyber Essentials controls and give you a clear remediation plan before you commit to a certification date.
