Available now/frameworks/cyber-essentials

Cyber Essentials

The technical controls buyers check before they trust you.

Cyber Essentials is a UK government-backed scheme (Requirements for IT Infrastructure v3.3) that sets out a baseline of technical controls to protect against common cyber attacks. Larger customers increasingly ask their suppliers to meet it, so its themes turn up in questionnaire after questionnaire.

Draft your Cyber Essentials answers free →

What Cyber Essentials covers

The scheme is built around five technical control themes. Tickbox grounds your answers in the current (v3.3) requirements:

Firewalls

Every internet-connected device is protected by a correctly configured firewall.

Secure configuration

Unnecessary accounts and software are removed, defaults changed, auto-run disabled.

Device unlocking

Screens lock behind a PIN, password, or biometric, protected against brute force.

Security update management

Critical and high-risk updates are applied within 14 days; unsupported software is removed.

User access control

Access is through unique accounts with least privilege and tightly controlled admin rights.

Multi-factor authentication

MFA is enabled wherever supported, and always for cloud services.

Passwordless authentication

Passkeys, biometrics, and security keys are supported as strong alternatives to passwords.

Password-based authentication

12-character passwords (or 8 with a deny-list), protected from brute force, no forced expiry.

Malware protection

Anti-malware or application allow-listing stops untrusted code from running.

Scope & cloud services

Cloud services and end-user devices are in scope and cannot be excluded.

Questions you might be asked

  • Are firewalls configured on every device that connects to the internet?
  • How do you keep devices securely configured and remove unused accounts?
  • Do you apply high-risk security updates within 14 days?
  • Is multi-factor authentication enabled on your cloud services?
  • How are administrator accounts restricted and reviewed?
  • How do you protect devices against malware?

How Tickbox helps

Tickbox recognises Cyber Essentials-style questions and drafts an answer for each, phrased in your own words and grounded in the current controls. You stay in control: every answer is a draft you review before sending, never a claim of certification.

Explore other frameworks

Answer these in minutes, not days

Drop your questionnaire in and Tickbox drafts every answer for you to review.

Try it free