What Cyber Essentials is
The UK government-backed baseline: firewalls, secure configuration, user access control, malware protection and security updates.
Who asks for it: UK government suppliers and most UK organisations.
What Microsoft 365 can show
Cyber Essentials sets 5 technical controls, listed here as 17 requirements. 8 can be evidenced from a Microsoft 365 tenant. The other 9 are about your network, your devices and your processes, so only you can confirm them.
A requirement counts as met only when every check behind it passes. A check that could not run leaves it unknown rather than met, because the scheme needs the control to exist.
Outside Microsoft 365
Boundary firewalls, routers, anti-malware on every device and patching timelines are answered by you on the Cyber Essentials page.
Readiness is not certification. ConfigCheckup shows how ready a tenant is; certification is assessed by an IASME certification body.
Every requirement, and who answers it
The same mapping as the in-product Cyber Essentials view, reviewed September 2026 against the NCSC’s published requirements.
Firewalls
Internet-connected devices sit behind a correctly configured firewall.
| Requirement | Evidenced from the tenant by | Only you can confirm |
|---|---|---|
| Every internet connection is protected by a firewall, with its default admin password changed and inbound rules limited to what is needed and documented. | Not visible in Microsoft 365 | Boundary firewalls and routers are in place, default passwords are changed, and every inbound rule is approved and documented. |
| Devices used on untrusted networks, such as home and public Wi-Fi, have their software firewall switched on. | Not visible in Microsoft 365 | The software firewall is on for every laptop and other device used outside the office. |
Secure configuration
Devices and cloud services are configured to reduce what an attacker can use.
| Requirement | Evidenced from the tenant by | Only you can confirm |
|---|---|---|
| Devices meet a defined secure configuration, enforced and reported by device management. | Nothing: it is read from the tenant | |
| Company data is only reachable from devices that meet that configuration. | Nothing: it is read from the tenant | |
| Cloud services have insecure defaults turned off: legacy authentication, unmanaged app consent and app registration by any user. | Nothing: it is read from the tenant | |
| Unnecessary software, services and accounts are removed or disabled, default passwords are changed, and auto-run is off. | Not visible in Microsoft 365 | Devices have unnecessary software and accounts removed, default passwords changed, and auto-run of downloaded content disabled. |
| Devices need a PIN, password or biometric to unlock, and lock after repeated failed attempts. | Not visible in Microsoft 365 | Every device requires a PIN, password or biometric to unlock, with lockout or throttling after failed attempts. |
User access control
Only the right people have accounts, with only the access they need, protected by MFA.
| Requirement | Evidenced from the tenant by | Only you can confirm |
|---|---|---|
| Multi-factor authentication protects every account on cloud services. | Nothing: it is read from the tenant | |
| Every administrator uses multi-factor authentication, preferably phishing-resistant. | Nothing: it is read from the tenant | |
| Administrative rights are held by as few people as possible, using separate cloud-only admin accounts. | Nothing: it is read from the tenant | |
| Accounts no longer needed, including privileged ones, are removed or disabled promptly. | Nothing: it is read from the tenant | |
| There is a process to create, approve and remove user accounts, and admin accounts are not used for email or web browsing. | Not visible in Microsoft 365 | Joiners, movers and leavers follow an approval process, and admin accounts are used only for administration. |
Malware protection
Malicious software is stopped from running on every device.
| Requirement | Evidenced from the tenant by | Only you can confirm |
|---|---|---|
| Anti-malware is installed, kept up to date and scanning on every device in scope, or applications are limited to an approved list. | Not visible in Microsoft 365 | Anti-malware (e.g. Microsoft Defender Antivirus) is active and up to date on every device, including BYOD in scope, or application allow-listing is enforced. |
| Access to known malicious websites is blocked. | Not visible in Microsoft 365 | Web protection blocks known malicious sites (e.g. Defender SmartScreen or network protection). |
Security update management
Software is supported and security updates are applied promptly.
| Requirement | Evidenced from the tenant by | Only you can confirm |
|---|---|---|
| Every device runs an operating system that still receives security updates. | Nothing: it is read from the tenant | |
| Critical and high-risk security updates are installed within 14 days of release, automatically where possible. | Not visible in Microsoft 365 | Automatic updates are on, and critical or high-risk security updates are applied within 14 days (e.g. Intune update rings with deadlines). |
| All software is licensed and supported, and unsupported software is removed. | Not visible in Microsoft 365 | All installed software is licensed and still supported by its vendor; unsupported software has been removed. |
Get ready for the assessment
- Cyber Essentials checklist for Microsoft 365: Every Cyber Essentials requirement across the five controls, where to check it in Entra, Intune and Defender, and what to confirm outside the tenant.
- Cyber Essentials evidence for MSPs: Evidence the Cyber Essentials requirements Microsoft 365 can show, tenant by tenant: MFA, admin accounts, devices, patching and more, with the gaps.
- Microsoft 365 security for schools and trusts: Check, fix and prove Microsoft 365 security in every school: pupils never count towards the price, and trusts see every school in one view.
Related frameworks
- Cyber Essentials Plus: Cyber Essentials, verified by an assessor’s technical tests.
- NCSC Cyber Assessment Framework: The NCSC’s outcome-based framework for essential services, the NHS and their suppliers.
- Data Security and Protection Toolkit: The NHS self-assessment for organisations that handle patient data.
- NCSC 10 Steps: The NCSC’s guidance for boards and organisations, in ten steps.