CYBUNKR

Tools

Cyber Essentials readiness check.

Answer yes, no or not sure to each of the Cyber Essentials requirements and get a fix-first list of what to sort out before you apply. It takes about five minutes, runs in your browser and nothing is sent to us.

Scope

Scope

What the assessment covers.

  1. Does your scope include every laptop, desktop, server, tablet and phone used for work, including staff-owned and home-working devices?
  2. Are all the cloud services that hold your data or run your services (for example Microsoft 365 or Google Workspace) in scope?
Firewalls

Firewalls

Only secure and necessary network services can be reached from the internet.

  1. Is every device protected by a correctly configured firewall, either your office firewall or router, or the firewall built into the device's operating system?
  2. Have the default admin passwords on your firewalls and routers been changed to strong, unique ones (or remote admin turned off)?
  3. Is the firewall or router's admin interface blocked from the internet, or, where there's a documented business need, protected by MFA or an IP allow list?
  4. Are unauthenticated inbound connections blocked by default?
  5. Is every inbound firewall rule approved and documented by an authorised person with its business need, and removed when no longer needed?
Secure configuration

Secure configuration

Devices are set up to reduce weak points and only run what they need.

  1. Have you removed or disabled user accounts you don't need, such as guest accounts and admin accounts that won't be used?
  2. Have all default or guessable account passwords been changed?
  3. Have you removed or disabled software you don't need, including applications, system utilities and network services?
  4. Is auto-run turned off, so files (for example downloads or USB drives) cannot run without the user agreeing?
  5. Does every device need a PIN, password or biometric to unlock, with at least 6 characters, locking or slowing down after no more than 10 wrong attempts?
Security update management

Security update management

Software is supported and patched quickly.

  1. Is all software licensed and still supported by its vendor, with unsupported software removed?
  2. Are automatic updates turned on wherever possible?
  3. Are critical and high-risk updates (CVSS v3 7 or above, or where the vendor gives no severity) installed within 14 days of release, including firewall and router firmware?
User access control

User access control

Accounts belong to authorised people and only have the access they need.

  1. Do you have a process to create and approve user accounts?
  2. Does everyone sign in with their own unique credentials, with no shared logins?
  3. Are accounts removed or disabled when people leave (or after a set period of inactivity), and extra privileges removed when they change role?
  4. Is multi-factor authentication (MFA) on for every cloud service, and everywhere else it's available?
  5. Do admins use a separate account only for admin work, with no email or web browsing on it?
  6. Are passwords protected against guessing (MFA, or locking or slowing down after 10 attempts) and backed by MFA, a 12-character minimum, or an 8-character minimum with common passwords blocked?
Malware protection

Malware protection

Known malware and untrusted software are stopped from running.

  1. Does every device have active malware protection: up-to-date anti-malware that blocks malware and malicious websites, or application allow listing?

0 of 22 answered

A guide only, based on the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. It doesn't cover every detail, and only a certification body can certify you. Backups aren't a Cyber Essentials requirement, but the NCSC strongly recommends them.