Cyber security has become an important part of running a modern business, particularly as organisations depend on computers, online platforms, and cloud-based services. The UK National Cyber Security Centre (NCSC) promotes Cyber Essentials as a practical way to improve protection against common online threats. Businesses preparing for the cyber essentials first step should understand the five technical controls used during the assessment. These controls provide a clear framework for reviewing existing systems, identifying areas that need attention, and building stronger security practices across the organisation.
1. Firewall Protection
Firewalls create an important security barrier between an organisation's internal systems and external networks. They monitor incoming and outgoing network traffic according to established security rules. Proper firewall configuration helps prevent unauthorised connections and reduces unnecessary exposure to online threats.
Businesses should ensure that firewalls are enabled on relevant computers, servers, and network equipment. Administrative access should also be protected with strong authentication. Regularly reviewing firewall rules helps organisations remove outdated permissions and maintain appropriate network protection.
2. Secure Configuration
Secure configuration focuses on setting up computers, mobile devices, servers, and applications correctly. Devices often include default settings, unnecessary applications, or accounts that are not required for everyday operations.
Organisations should review these settings before devices become part of their working environment. Removing unused accounts, changing default passwords, disabling unnecessary services, and applying suitable security settings can reduce avoidable weaknesses.
A consistent configuration approach also makes it easier for IT teams to manage devices and maintain reliable security standards across the business.
3. Security Update Management
Software providers regularly release updates to improve performance, fix technical issues, and address security vulnerabilities. When organisations delay important updates, their systems may remain exposed to weaknesses that have already been addressed by developers.
Security update management requires businesses to monitor the software they use and apply relevant updates within the required timeframes. This includes operating systems, applications, network equipment, and supported cloud services.
Maintaining an accurate software inventory helps IT teams identify outdated products and plan updates efficiently. Businesses should also replace software that no longer receives security support.
4. User Access Control
Not every employee needs access to every business system or information resource. User access control ensures that individuals receive permissions appropriate to their responsibilities.
Organisations should provide separate accounts where required, remove access when employees leave, and regularly review administrative privileges. Multi-factor authentication (MFA) adds another layer of protection by requiring additional verification during account sign-in.
These practices help businesses manage digital access more effectively while reducing unnecessary permissions.
5. Malware Protection
Malware protection helps organisations identify and manage harmful software that could affect computers, applications, and business information. Suitable protection may include built-in operating system security features, supported anti-malware software, and application controls.
Businesses should keep their protection tools updated and ensure that security features remain active. Employees should also understand the importance of downloading applications from trusted sources and following established workplace procedures.
Preparing for a Successful Assessment
The five technical controls work together to create a consistent security foundation. Improving only one area is not enough because an assessment considers the organisation's overall approach to the applicable requirements.
Before applying, businesses should identify all devices and services within their assessment scope, review existing configurations, check account permissions, and confirm that security updates are being maintained.