Cyber Essentials checklist for SMEs

The Cyber Essentials checklist covers five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. For each control you must be able to show it applies to every in-scope device, network and cloud service — including laptops used at home. Before working through the controls you also need an accurate scope: a list of every device, user and cloud service used for business work. The self-assessment questionnaire asks direct, factual questions against each control, so the practical checklist is really an evidence-gathering exercise: confirm the control is in place, confirm it covers everything in scope, and be ready to describe how.

Start by defining scope — list every device, user and cloud service used for business work, including remote and personally owned devices used for email. Then run a gap analysis against the five controls, recording where each one is already met and where it is not. Fix the gaps in order of effort: enabling multi-factor authentication, removing unused admin accounts, turning on software firewalls and retiring unsupported software usually account for the bulk of the work. Once the gaps are closed, complete the self-assessment questionnaire honestly and submit it to an accredited certifying body. Most SMEs need between two and eight weeks.

The most frequent failures are unsupported software still in use (an old Windows machine or an end-of-life server), missing multi-factor authentication on cloud administrator accounts, security updates not applied within the required 14 days, shared or unnamed user accounts, and default passwords left in place on routers, firewalls and network storage. A fifth common failure is scope: an application that describes only the office network while staff work from unmanaged home devices. None of these are difficult to fix, but they are difficult to fix quickly, which is why a gap analysis before you apply saves both time and a resubmission.

A well-run SME with modern devices, Microsoft 365 and consistent patching can work through the checklist in a few days and certify within two to three weeks. A business with legacy hardware, no central device management or inconsistent patching should plan for six to eight weeks, because remediation — not the questionnaire — is where the time goes. Retiring unsupported software and rolling out multi-factor authentication across everyone are usually the two longest tasks. The assessment itself is typically reviewed by the certifying body within a few working days of submission.

Usually not. Most UK SMEs already own everything they need: Windows and macOS include built-in firewalls and anti-malware, and Microsoft 365 and Google Workspace both include multi-factor authentication at no extra cost. The spend, where there is any, tends to go on replacing devices that can no longer receive security updates, or on a management tool that lets you prove patching and configuration across a fleet rather than device by device. Buy after the gap analysis, not before it — otherwise you risk paying for tooling that addresses a control you already meet.

The same five controls apply to both levels, so this checklist is the right starting point for either. The difference is verification: Cyber Essentials is a self-assessment reviewed by a certifying body, while Cyber Essentials Plus adds an independent technical audit with vulnerability scans and hands-on checks on a sample of your devices. Anything that is described inaccurately on a self-assessment will be found during a Plus audit, so if Plus is your goal, treat every item on this checklist as something an assessor will test rather than something you can simply assert.

A confident SME with in-house IT can self-certify — the scheme was deliberately designed to be achievable without a security team. Help is worth it when you have mixed or unmanaged devices, no clear picture of your patching status, staff working from personal equipment, or a contract deadline that makes a failed submission expensive. As an IASME certified Cyber Essentials assessor, we run the gap analysis, tell you plainly what would fail today, handle remediation and submit the assessment. Either way, do the gap analysis before you apply.