Cyber Essentials

ICT9 LTD will ensure your IT infrastructure meets Cyber Essentials. This is a set of requirements set out by the UK Government that reduce the risks of loss or damage to your organisation through poor IT security practices.

This is a simplified overview designed to give business owners and managers an introduction to the steps required to become certified. The full requirements (version 3.3, April 2026) are set out on the National Cyber Security Centre website (opens in a new tab).

1. Scope

• Identify all devices and software in your organisation that connect to the Internet, either directly or indirectly. This includes personal devices (BYOD) which access your organisation’s data or services.
• Include:
  • all cloud services you use: IaaS (Infrastructure as a Service), PaaS (Platform as a Service) and SaaS (Software as a Service). Cloud services cannot be excluded from scope.
  • all externally managed services.
  • all publicly available commercial web applications.
• Exclude:
  • bespoke and custom components of web applications, such as those developed in-house.

2. Firewalls

• Ensure each device is protected by a boundary firewall or a host-based firewall.
• Only the required ports are open.
• Open ports must be documented and include the business requirement.

3. Secure Configuration

• Restrict administrative access with secure passwords, multi-factor authentication and conditional access.
• Always use multi-factor authentication to sign in to cloud services.
• Use technical controls to enforce authentication requirements; shift the burden away from individual users.
• Ensure any system that relies on password-based authentication is not vulnerable to a brute-force attack.
• Ensure only authorised users can access the device.
• Default configurations must be checked to ensure compliance.

4. User Access Control

• Ensure user accounts are assigned to authorised individuals only.
• Only provide access to devices, data and services where there is a business requirement.
• Have a user account approval, creation and revocation process.
• Have an administrative account approval, creation and revocation process, and policies describing when the administrative account should be used.
• Use administrative accounts only for administrative activities and not for standard user activities.
• Ensure users are aware of password policies and have a level of security awareness.
• A process to manage special access privileges and ensure they are removed when no longer required (for example when a member of staff changes role).

5. Malware protection

• Before any software is allowed to execute, it must be either:
  • Scanned with anti-malware software that is kept up to date in line with the vendor’s recommendations (for Windows and macOS devices); or
  • Pre-approved using an allow list, with applications restricted by code signing.

6. Patch management

• All software must be licensed and supported, and removed from devices when no longer supported.
• Patch updates marked as critical or high risk (or where the vendor gives no severity) must be applied within 14 days of release.

To make it as easy as possible for your organisation to meet security and regulatory requirements:

1. We use modern Cloud services such as Microsoft Entra ID and Tailscale.
2. We provide training and mentorship for your nominated Tech Lead to ensure they are correctly administering your systems.
3. We provide guidance, management and oversight for business owners and stakeholders.
4. We make security as easy as possible for your users, by using modern technology such as Password-less authentication, Windows Hello for Business and Microsoft Entra ID Single Sign-On.