For a CTO, Cyber Essentials turns into an estate audit: every device, cloud account and network boundary is checked against five controls. Firewalls, secure configuration, security update management, user access control and malware protection are the same on paper for every company, so your decisions are about how to enforce them across a modern, mostly cloud stack.
How does each control map to a modern stack?
Firewalls. The NCSC defines this as a security filter between the internet and your network. In a cloud-first company that means host firewalls on laptops, security groups on cloud resources, and no unneeded open ports on anything internet facing. Home routers matter less when devices carry their own firewall.
Secure configuration. Remove default accounts and passwords, switch off unused services and features, and set devices to sensible defaults. Infrastructure as code helps here, because the configuration is visible and reviewable.
Security update management. Software must be kept supported and patched. This covers operating systems, browsers, mobile devices, firmware and the cloud images you run. Fixed windows for patching exist in the scheme's requirements, so read the current requirements document for the exact figures instead of relying on memory.
User access control. Accounts are granted by need, admin rights are limited, and strong authentication is used. Multi-factor authentication is a major theme for cloud services in the scheme.
Malware protection. Anti-malware or an application allow-listing approach on devices that need it.
What decisions does this force?
The first is device policy. Managed devices make every control easier to evidence. If staff use personal laptops or phones for work, you must either enrol them or exclude them from scope, and the second option shrinks what the certificate says.
The second is identity. A single identity provider with enforced multi-factor sign-in is the simplest way to satisfy access control across SaaS tools, and a prerequisite for clean offboarding.
The third is patch ownership. Someone must own the monthly patching of laptops and the base images behind your workloads. Automatic updates plus a report of exceptions is stronger evidence than a calendar reminder.
Which level should you choose?
Cyber Essentials is verified self-assessment: your answers are signed off by a board member or equivalent and marked by an assessor. Cyber Essentials Plus adds independent technical testing of your systems, so a tester samples your devices and checks the controls work. If a customer demands Plus, plan for devices to be tested and fix findings quickly.
What should a CTO delegate?
Delegate the evidence gathering: device lists, patch reports, account lists. Keep the scope decision and the sign-off conversation, because scope defines what the certificate means to a buyer. The NCSC and its delivery partner, IASME, also provide a free question set and a readiness tool you can use before you pay for anything.
What does it not prove?
It does not examine your application code, your software supply chain, or how you handle customer data. Pair it with other practices if your buyers care about those, and describe it honestly: independent verification of five baseline controls.
How to check or apply this
- Build one inventory of devices, operating systems and cloud accounts.
- Enforce multi-factor sign-in at the identity provider and list exceptions.
- Turn on automatic updates and report devices that lag.
- Remove default and shared admin accounts.
- Check inbound rules on cloud resources and remove unneeded exposure.
- Run the free readiness tool, fix findings, then book the assessment.
Quick check
Do cloud services fall under the scheme?
Yes. Cloud services that hold company data are part of the estate, and access control and multi-factor sign-in are central to them.
Who signs off a self-led assessment?
A board member or equivalent, before an assessor marks the answers.
Sources
Last reviewed: 18 October 2026.
