All services Every engagement has a fixed, published price. Book a strategy call
All five Cyber Essentials controls explained through the attacks they stop: what each control is for, how to implement it properly, the twenty minute version of each, and how the five work together as a system.
Most guides to the Cyber Essentials controls explained online describe what each control is. This one explains why each control exists: the attack it was designed to stop, what implementing it well looks like, and the twenty minute version when you need progress today. It is written by an IASME licensed certification body, so the failure patterns described here come from marking real assessments rather than imagination. If you want the formal requirement-by-requirement reference instead, that is our Cyber Essentials requirements guide. This article is about doing the controls well.
The short version. The five Cyber Essentials controls are firewalls, secure configuration, user access control, malware protection and security update management. They were not chosen to be impressive. They were chosen because the attacks that hit UK organisations are unglamorous, and these five stop most of them. Implemented properly, the controls are less a compliance exercise than a description of tidy IT, and the organisations that treat them that way pass the assessment as a side effect.
Here are all 5 controls, each paired with the attack it exists to stop. For Cyber Essentials controls UK organisations must implement, these five technical controls are the complete list. This pairing is the key to implementing them well, because a control you understand as a defence gets maintained, while a control you understand as paperwork gets forgotten the week after certification.
| Control | What it is | The attack it stops |
|---|---|---|
| 1. Firewalls | A guarded boundary between your systems and the internet | Attackers scanning the internet for exposed services and open doors, which they do constantly and automatically |
| 2. Secure configuration | Devices and software stripped of defaults and unused extras | Attacks on factory passwords, forgotten accounts and features nobody knew were switched on |
| 3. User access control | The right people with the right access, verified strongly | Account takeover: stolen and guessed passwords, the single most common way into a small organisation |
| 4. Malware protection | Something on every device that stops malicious software running | Ransomware and infostealers arriving through email attachments, downloads and poisoned websites |
| 5. Security update management | Known holes closed within 14 days, everywhere | Exploitation of published vulnerabilities, which attackers weaponise within days of disclosure |
The attack this control stops runs continuously whether you have noticed or not. Automated scanners sweep the whole internet looking for management pages, remote desktop services and forgotten test systems that answer from your address. When they find one, a human follows up. The firewall control makes your organisation boring to those scanners: inbound connections blocked by default, nothing exposed without a documented reason, and the router’s own admin page unreachable from outside.
| Do this | Why it matters |
|---|---|
| Change the router and firewall admin passwords, today | Factory credentials for every router model are documented online. Attackers try them first |
| Block inbound by default. Document every exception | Every open service is a doorway. The documentation requirement forces someone to own each one |
| Disable remote administration from the internet | The management page of your firewall is the last thing that should face the world. If remote access is genuinely needed, protect it with MFA or source restrictions |
| Turn on the software firewall for laptops that travel | A laptop on café wi-fi has no office firewall in front of it. Its own firewall is the boundary |
The twenty minute version: log into your router, change the admin password, switch off remote management, and list every port-forwarding rule. Anything nobody can explain gets closed.
New devices and services arrive configured for convenience rather than safety: sample accounts, default passwords, every feature on. Attackers know these defaults better than the manufacturers’ own support desks. Secure configuration is the discipline of stripping each device to what the business uses, and its enemy is drift, the slow accumulation of convenience decisions that nobody ever reviews.
| Do this | Why it matters |
|---|---|
| Remove or disable accounts and software nobody uses | Every unused account is an unwatched door. Every unused application is unpatched attack surface |
| Hunt down default passwords beyond the obvious places | Printers, network storage, meeting room kit and cameras all ship with known credentials and all sit on your network |
| Disable auto-run everywhere | Files should run because a person chose to run them rather than because a USB stick was inserted |
| Enforce device locking: biometrics, password, or a PIN of at least six characters | A lost phone with company email should be a nuisance rather than an incident |
| Write the setup checklist once, use it for every new device | Secure configuration survives as a process rather than a memory |
The twenty minute version: pick your most-used laptop and audit it: accounts, installed software, lock settings. What you find on one device tells you the state of the fleet.
Account takeover is how most small organisations get breached. Nobody defeats your firewall. They log in through the front door with a password stolen by phishing, leaked from another service, or guessed at machine speed. This control makes stolen passwords nearly worthless, which is why it now carries the scheme’s hardest rule: multi-factor authentication missing from any cloud service that offers it fails the whole assessment.
| Do this | Why it matters |
|---|---|
| Roll out MFA in this order: email first, then finance, then everything | Email resets every other password, which makes it the crown jewels. Finance systems move money |
| Give every person their own account, and remove leavers the day they leave | Shared accounts make investigation impossible. Former staff accounts are breaches waiting for a motive |
| Separate admin accounts from daily driving | Malware runs with the rights of the person who opened it. Browsing as an administrator hands it the keys |
| Meet the password rules with a password manager | With MFA, 8 characters minimum. Without MFA, 12, or 8 with common passwords blocked. A password manager makes the rules effortless and ends reuse |
| Consider passkeys where your platforms support them | Passwordless authentication is now recognised by the scheme and removes the phishable secret entirely |
The twenty minute version: open your email platform’s admin panel and check MFA enrolment for every user. Anyone without it, including and especially directors, enrols today.
Malware arrives the boring way: an invoice attachment, a cracked download, a poisoned advert. Once running, modern malware steals credentials and session tokens or encrypts everything it can reach. The control requires an active defence on every in-scope device, and the scheme accepts two routes: anti-malware software that is updated, scanning and blocking malicious websites, or an approved application list where only known software can run. Sandboxing alone no longer qualifies.
| Do this | Why it matters |
|---|---|
| Verify protection is configured rather than just present | Installed is not the requirement. Updating, scanning on access and blocking malicious sites is |
| Cover every device, phones included | The control applies per device. For phones and tablets, restricting installs to official app stores with an approved list is the practical route |
| Consider allow-listing for fixed-purpose machines | Tills, kiosks and workshop PCs run the same few applications forever. An approved list suits them better than signatures |
| Check that nobody can simply switch it off | Protection a standard user can disable will be disabled the first time it inconveniences someone |
The twenty minute version: pick three devices at random and check the protection is on, updating, and last scanned recently. Three random passes is evidence. Three surprises is a project.
When a vulnerability is published, a race starts: vendors ship the fix, attackers weaponise the hole, and the only question is which reaches your systems first. The control sets the finish line at fourteen days for high-risk and critical fixes, measured from release, and the 2026 rules made it the scheme’s second automatic failure. It also quietly enforces the hardest discipline in small-business IT: retiring software that no longer receives fixes at all.
| Do this | Why it matters |
|---|---|
| Turn on automatic updates everywhere they exist | Automation applies fixes while people are busy. Fourteen days disappears fast when updates wait for volunteers |
| Hold a monthly thirty minute patch review | One recurring meeting catches what automation missed: firmware, the odd application, the machine that was asleep |
| Retire unsupported software, or genuinely segregate it | Out-of-support systems receive no fixes and fail the assessment. If one truly cannot go, it must be isolated from the in-scope network |
| Remember firmware | Routers and firewalls run software too, and their updates are the ones everybody forgets |
The twenty minute version: check the oldest device in the building. If its operating system is still supported and up to date, your worst case is fine. If not, you have found this month’s job.
The five Cyber Essentials controls are a system rather than a menu, and their real design principle is that each covers the others’ failures. The firewall keeps scanners out. When something slips past it, secure configuration means there is less to attack. When a password leaks anyway, MFA makes it useless. When a user opens the wrong attachment, malware protection catches it, and when the malware is too new to catch, the fact that the user was not an administrator limits the blast. Updates, meanwhile, shrink the holes everything else has to defend. Remove one control and the others carry weight they were never meant to hold, which is why the scheme certifies all five together and why implementing four and a half is worth less than it sounds.
The five controls themselves did not change in 2026. The tolerance for skipping the two most exploited ones did. Multi-factor authentication missing from any cloud service that offers it now fails the assessment outright, and so do high-risk security updates applied slower than fourteen days, through the named auto-fail questions A6.4 and A6.5. Cloud services are also formally always in scope. The full picture, including dates and transition rules, is in our Cyber Essentials 2026 changes guide.
Firewalls: admin passwords changed · inbound blocked by default · exceptions documented · remote management off · software firewalls on travelling laptops.
Secure configuration: unused accounts and software removed · no default credentials anywhere, printers included · auto-run off · device locking enforced · a written setup checklist for new devices.
Access control: MFA on every cloud service, email first · unique accounts · leavers removed same day · admin accounts separate · password rules met, ideally via a password manager.
Malware protection: active on every device including phones · updating and scanning verified · not disableable by standard users · allow-listing considered for fixed-purpose machines.
Updates: auto-update on everywhere · monthly patch review in the diary · nothing out of support · firmware included · fourteen days treated as a deadline rather than a target.
The scheme’s designers kept the list short on purpose, so it is worth knowing what sits outside it. Backups are strongly recommended and the guidance now gives them more prominence, but they are not a marked control. Logging, monitoring, staff training and incident response plans are all sensible and all absent. Asset management is not one of the five either, although it quietly underpins every one of them, because you cannot secure devices you have not listed. And nothing in Cyber Essentials constitutes a management system: risk assessment, supplier security and governance live in ISO 27001 territory. The five controls are the floor, deliberately affordable and deliberately narrow. Treat them as the start of security rather than the end of it.
We certify organisations against these controls as an IASME licensed certification body. Cyber Essentials certification costs the official fee of £320 to £600 + VAT by size. Guided certification at £950 + VAT walks every control in this article through your actual estate, and Cyber Essentials Plus, where an assessor verifies the controls hands-on, is £1,150 + VAT, fixed. All pricing detail lives in the cost guide.
Firewalls, secure configuration, user access control, malware protection and security update management, applied across every in-scope device and cloud service. Each targets one of the common attack routes into UK organisations.
The controls are the five defence areas. The requirements are the specific, testable rules within each one, plus the scope rules. This article explains the controls and how to implement them. Our requirements guide lists every rule as an assessor marks it.
The controls are the same. The marking hardened. Missing MFA on any cloud service that offers it, and high-risk updates slower than 14 days, now fail the assessment automatically, and cloud services are formally always in scope.
Security update management, usually through one forgotten out-of-support system or updates that rely on users clicking restart. Access control is second, almost always through incomplete MFA coverage.
No, but it underpins all five: you cannot firewall, configure, control access to, protect or update devices you have not listed. A current asset list is the practical first step of every control.
Yes, identical controls. Plus changes the verification: an assessor tests a sample of devices directly rather than relying on the self-assessment, with vulnerability scans and email, browser and malware tests.
They remove the most common entry routes: phishing-led account takeover, unpatched vulnerabilities and malicious attachments. No control set makes ransomware impossible, which is why backups, though not a marked control, are strongly recommended alongside the five.
A tidy small organisation can verify all five in days. Organisations with legacy kit or loose access typically need two to six weeks, with MFA rollout and retiring unsupported software the usual long poles.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
