Are you ready for Cyber Essentials?

Is every in-scope device behind a boundary firewall, or running a host firewall when it is used away from the office?

Have default administrator passwords on every firewall and router been changed?

Is inbound traffic blocked by default, with every open rule approved and documented?

Are unused accounts and unneeded software removed or disabled on every device?

Do devices lock, and need a biometric or a PIN or password of at least six characters to unlock?

Is password guessing limited by lockout or throttling on all accounts?

Are Intune compliance policies applied to every device that reaches your data?

Is every operating system and application in scope still supported by its vendor?

Are critical and high-risk security updates applied within 14 days of release?

Are updates set to install automatically, with a deadline, through Intune or another tool?

Is MFA enforced for every user of Microsoft 365, including administrators?

Is legacy authentication (which skips MFA) blocked?

Do administrators use separate admin accounts only for admin work?

Are leavers’ accounts disabled promptly, and access reviewed regularly?

Is anti-malware (such as Microsoft Defender) running and up to date on every device, or is application allow-listing in place?

Are malicious websites blocked or warned on, through SmartScreen, network protection or web filtering?