Cyber Essentials Checklist

Cyber Essentials Checklist for SMEs: Are You Compliant?

Cyber attacks on UK businesses are rising — and small and medium-sized enterprises (SMEs) are just as vulnerable as large corporations. That’s why the UK government’s Cyber Essentials certification exists: to help you put the right controls in place to protect against the most common cyber threats.

We specialise in helping SMEs achieve both Cyber Essentials and Cyber Essentials Plus certification. Whether you’re aiming to boost customer trust, meet tender requirements, or simply strengthen your defences — we’ll guide you through the process from start to finish.

This blog outlines our Cyber Essentials checklist for SMEs, so you can understand what’s needed — and where you might need support.

1. Firewalls and Internet Gateways

A secure firewall acts as your business’s first line of defence.

  • Is your office network protected by a physical firewall?

  • Are software firewalls on all computers and servers; there are no excemptions

  • Have default firewall passwords been changed?

  • Are open ports declared and justified with regular reviews?

 Avoid exposing firewall configuration settings to the internet unless necessary — and if you must, protect access with MFA or IP restrictions.

2. Secure Configuration

Your devices should be configured to minimise vulnerabilities.

  • Are unused accounts and software disabled or removed?

  • Have you changed default admin passwords on all devices?

  • Is auto-run disabled for USBs and CDs?

  • Are strong lock screens enabled (e.g. fingerprint, PINs, or secure passwords)?

 3. Access Control

Controlling who has access to your systems is critical.

  • Are administrator accounts only used when required?

  • Does each staff member have a unique login?

  • Are departing users’ accounts deactivated promptly?

  • Are permissions based on job roles (least privilege)?

4. Malware Protection

You need to stop malicious software before it causes harm.

  • Are anti-virus or zero-trust tools like ThreatLocker in place?

  • Are apps limited to official app stores on mobile devices?

  • Does your system block access to known malicious websites?

  • Do you have a list of approved business apps?

 5. Patch Management & Software Updates

Outdated software is a security risk — and non-compliant.

  • Are all operating systems and software supported by the vendor?

  • Is auto-update enabled on all devices where possible?

  • Are critical security updates installed within 14 days?

  • Are unsupported systems removed or isolated from the internet?

You must also declare the version numbers of all major software (browsers, antivirus, office, email) as part of Cyber Essentials.

Download the Cyber Essentials Checklist (PDF)

We’ve turned this guide into a handy downloadable checklist you can use to audit your setup or share with your IT team.

Not Sure Where You Stand?

Whether you’re just starting out or preparing for a re-certification audit, Better-IT can help. We support you throughout the entire Cyber Essentials or Cyber Essentials Plus process — including technical advice, remediation support, and audit preparation.

Book a Free 15-Minute Discovery Call.
Let’s walk through your current position and your next steps.