A Cyber Essentials application often exposes issues that have been tolerated for too long: an old laptop in a cupboard, former staff accounts still active, unsupported software, or updates that depend on somebody remembering. The top Cyber Essentials preparation steps are not about producing paperwork for its own sake. They are about getting a clear, defensible view of the technology your business relies on and closing gaps before they become an operational or security problem.
For most small and medium-sized organisations, the challenge is not a lack of intent. It is that IT has grown in stages – new cloud services, remote workers, mobile devices, a second site or a supplier-managed connection – without one person holding a complete view. A structured preparation process brings those moving parts back under control.
Start with the right Cyber Essentials scope
Before checking a setting or buying a security tool, decide what is in scope. Cyber Essentials covers the systems, devices and services your organisation uses to process business data or connect to the internet. That can include office PCs, laptops used at home, mobile phones, servers, routers, wireless networks, cloud-based applications and accounts managed by a third party.
This is where businesses can either make the assessment harder than it needs to be or overlook something material. A sensible scope should reflect how people actually work, not how the network diagram looked two years ago. If staff access Microsoft 365 from personal devices, for example, those devices and the controls around access need careful consideration. If a hosted phone system, CCTV platform or guest WiFi is managed separately, establish how it connects and who is responsible for its security.
Create a straightforward inventory showing each asset, its owner, its operating system or service, and whether it is supported and still needed. Include network equipment, not just computers. An accurate list gives you a practical baseline for the rest of the work and makes future reviews far less disruptive.
Apply the top Cyber Essentials preparation steps in order
The certification is built around five technical control areas. They work together, so it is better to address them methodically than to treat each as an isolated task.
1. Secure your internet gateways and network devices
Your firewall, router and internet-facing equipment are the first line of control between your business and the wider internet. Check that default administrator passwords have been replaced with strong, unique credentials, that remote administration is disabled unless there is a defined operational need, and that access is restricted to authorised people.
Configuration matters as much as the equipment itself. Remove old port-forwarding rules, accounts belonging to former suppliers and services that were set up for a one-off project. If remote access is needed, use an approved method with multi-factor authentication rather than leaving management interfaces exposed to the internet.
Many organisations rely on a broadband provider, IT provider or firewall vendor to manage this layer. That is entirely reasonable, but accountability should still be clear. Know who applies updates, who reviews rules and who responds if an alert identifies suspicious activity.
2. Remove insecure defaults and standardise configuration
Secure configuration means setting up devices and software so they are not left more open than necessary. This includes removing unused applications, disabling unnecessary user accounts and ensuring screens lock after a suitable period of inactivity.
Standardisation makes this achievable. A business with ten laptops configured in ten different ways will struggle to prove that controls are consistently applied. Where possible, use central management to apply security settings, encryption, approved applications and password policies across devices.
There will be exceptions. A specialist device in a school, healthcare setting or engineering environment may need older software or a fixed configuration to run essential equipment. Do not simply ignore the risk. Document why the exception exists, limit its network access, and agree compensating measures such as segmentation, restricted user permissions or a replacement plan.
3. Review user access, especially privileged accounts
Most avoidable security failures start with access that is broader or longer-lasting than it should be. Review who has accounts, what they can reach and whether they need administrator privileges. Everyday work should normally be carried out using a standard account, with elevated access reserved for specific support and administration tasks.
Pay particular attention to joiners, movers and leavers. When somebody changes role or leaves, access to email, files, finance systems, cloud applications, mobile device management and shared passwords must be reviewed promptly. This process should not depend on an informal message between managers.
Multi-factor authentication is a significant protection for email, cloud services and remote access. It reduces the chance that a stolen or guessed password alone can give an attacker entry. It does add a small step for users, so choose methods that suit your workforce and provide clear guidance before enforcement. Convenience is relevant, but the cost of a compromised account is usually much higher.
4. Maintain protection against malware
Every in-scope device needs appropriate protection against malicious software. For many businesses, centrally managed endpoint security is the practical option because it provides visibility over whether protection is installed, active and receiving updates.
However, software alone is not the answer. Attackers often use legitimate-looking emails, fake login pages and compromised supplier accounts rather than obvious malicious attachments. Pair technical protection with sensible controls over downloads, application installation and administrative rights. Staff should also know how to report a suspicious message without worrying that they are wasting IT’s time.
For organisations with remote workers, confirm that devices remain protected away from the office. A laptop that only receives updates or security checks when it returns to site creates an unnecessary blind spot.
5. Keep software and firmware up to date
Security update management is frequently the most time-sensitive part of preparation. Unsupported operating systems, unpatched applications and old firewall firmware can all leave known weaknesses exposed. Start by identifying what is installed, then check that it remains supported by its vendor.
Set a realistic process for applying updates. Critical security fixes should be dealt with promptly, while routine updates can follow a planned schedule with testing where needed. The right balance depends on the business: a standard office environment may update quickly with little disruption, while a production system or clinical device may need a tested maintenance window.
Do not limit the review to Windows or macOS. Web browsers, PDF readers, office applications, mobile operating systems, wireless access points, switches and cloud application settings all deserve attention. Where a supplier manages an element, obtain confirmation of its update responsibilities rather than assuming it is covered.
Prepare evidence before you begin the assessment
Cyber Essentials is not a box-ticking exercise, but preparation is easier when answers can be supported. Keep records of your asset inventory, software support status, update process, access reviews, firewall responsibility and any documented exceptions. You do not need an elaborate compliance platform to do this. A maintained register and clear internal procedures are often more useful than a large folder of documents nobody checks.
Run a short internal review using the assessment questions before submitting anything. Ask the people who manage IT, HR onboarding, finance applications and facilities to confirm their parts of the picture. This is particularly valuable where IT, connectivity, cabling, CCTV and cloud services have been purchased from different suppliers.
Be accurate rather than optimistic. If a control is not consistently in place, fix it before applying or seek specialist advice on the most proportionate route. Misunderstanding a question can delay certification; hiding a gap leaves the underlying risk untouched.
Make Cyber Essentials part of normal operations
Certification is most valuable when it supports reliable day-to-day working. Build the controls into regular routines: review users when employment changes, check device status monthly, schedule patch reporting, and reassess suppliers or new services before they are introduced.
For a growing business, this may be the point where managed IT support becomes worthwhile. The benefit is not simply outsourcing a checklist. It is having clear ownership of updates, monitoring, access management and advice when technology changes. iData works with organisations that need this joined-up approach across IT, connectivity and security, without adding unnecessary complexity.
A well-prepared Cyber Essentials application should leave your business in a better position than when it started: fewer unknown devices, clearer responsibilities and less opportunity for a routine oversight to interrupt the working day. That is a useful outcome whether certification is requested by a customer, required for a contract or simply part of running the business responsibly.