A Cyber Essentials application can expose issues that have been quietly accumulating for years: unsupported software on a finance laptop, administrator accounts shared by an IT team, or devices that have not received updates because nobody owns the process. The best cyber essentials readiness steps do more than prepare an organisation for a questionnaire. They establish clear control over the systems, people and suppliers that keep the organisation running.
For SMEs, schools, colleges and Multi-Academy Trusts, the practical challenge is rarely knowing that security matters. It is finding time to assess the real environment, resolve gaps without disrupting users and retain evidence that decisions have been made properly. A structured readiness programme turns that challenge into manageable work.
Start with a realistic Cyber Essentials scope
Certification is only meaningful when the scope reflects how the organisation operates. Begin by documenting the devices, operating systems, cloud services, networks and user groups that will be included. This should cover staff laptops, desktops, servers, mobile devices and remotely used equipment, as well as Microsoft 365 or other cloud platforms where they are part of daily work.
Do not treat the network boundary as the whole answer. A small organisation may have staff working from home, using mobile devices and accessing cloud applications directly. A school or Trust may have multiple sites, shared administrative teams and separately managed curriculum devices. The scope needs to show where organisational information is accessed and who is responsible for securing each part.
It is reasonable to phase work where legacy platforms are being replaced, but exclusions must be legitimate and carefully understood. Leaving an older system out of scope does not remove the risk if it handles business, pupil or staff data, connects to the wider network or relies on the same user accounts. Resolve scope questions before completing the assessment rather than trying to explain them after submission.
Best Cyber Essentials readiness steps: build the evidence first
The Cyber Essentials assessment asks how controls operate in practice. Readiness is therefore not just a technical exercise. Assign an accountable owner for each answer and collect the evidence that supports it. This avoids last-minute assumptions, particularly where IT is shared between an internal team, a managed service provider and individual departments.
A useful evidence pack normally includes an up-to-date asset register, a list of approved software, a record of supported operating systems, user and administrator account lists, patching reports, firewall or router settings, and written policies for password management and device use. It need not become a large compliance folder. It does need to be accurate enough for leadership to rely on.
Where an answer depends on a supplier-managed service, ask for confirmation rather than relying on marketing claims. For example, establish who applies updates to a hosted platform, whether multi-factor authentication is enforced, how administrative access is controlled and what happens when a user leaves. Clear ownership is a core security control in its own right.
Verify the five technical control areas
Cyber Essentials is built around five control themes. They are straightforward in principle, but the detail often reveals inconsistent processes.
Secure your internet gateways and devices
Check that firewalls or internet gateways are active, correctly configured and protected by unique administrator credentials. Default passwords, unmanaged routers and unnecessary inbound access are common weaknesses. Remote management should be restricted to those who genuinely need it, and settings should be reviewed after network changes or supplier handovers.
Secure configuration also means removing what is not needed. Disable unused accounts and services, avoid giving users local administrator rights as a matter of convenience, and use standard device builds wherever possible. A documented baseline makes new starters, replacement equipment and incident recovery much easier to manage.
Control access without slowing down the organisation
Access should follow job role, not historical habit. Review user accounts, shared mailboxes, groups and privileged accounts to ensure that staff have only the access required for their work. Pay particular attention to leavers, temporary staff, governors, contractors and external support providers. These accounts are often created for a valid reason but are not always removed promptly.
Multi-factor authentication is one of the most effective protections against stolen passwords, especially for email, cloud administration and remote access. It does introduce a small amount of friction for users, so communicate the change well and provide a recovery process for lost mobile phones or changed devices. Security controls work best when staff know what to expect and where to get help.
For Trusts and education settings, identity management can be more complicated because staff may work across several schools, and students may use shared or short-term devices. Centralised account lifecycle processes and role-based access are usually more reliable than informal local arrangements.
Protect against malware with practical choices
Anti-malware protection should be installed, enabled and kept current on relevant devices. However, the stronger objective is to reduce the chances of malicious software running at all. Restricting local administrator rights, controlling which applications can be installed and blocking risky attachments or web content all reduce exposure.
The right approach depends on the environment. An organisation with specialist software may need carefully managed exceptions. A school may need different controls for staff and pupil devices. Any exception should have a named owner, a reason and a review date. Exceptions that are never revisited become permanent gaps.
Make patching measurable
Patching is where intentions need to become routine. Identify all operating systems, applications, browsers, firewall firmware and cloud-managed services that require updates. Then confirm the target timescales, the person or provider responsible, and how completion is checked.
Critical security updates should not wait for the next convenient maintenance window without a clear risk decision. At the same time, applying every update instantly may be unsuitable for a business-critical application or a large education estate. Use testing where needed, but maintain an escalation route for urgent vulnerabilities and keep a record of delayed patches and compensating controls.
Unsupported software requires particular attention. If it cannot receive security fixes, it may prevent certification and creates an ongoing operational risk. Replacement, isolation or retirement should be planned with leadership involvement, because this is a budget and continuity issue as much as a technical one.
Test the processes people rely on
A readiness review should include a sample of real-world checks. Ask whether a recently departed employee can still sign in. Confirm that a newly issued laptop receives the required security settings. Review whether an administrator account is distinct from a normal daily-use account. Check that a device missing updates is identified and followed up.
This kind of testing is valuable because written policies can look complete while day-to-day processes fail under pressure. It also gives senior leaders a clearer view of risk: not a technical list of settings, but evidence of whether the organisation can control access, respond to change and maintain essential services.
Staff awareness has a role here, even though Cyber Essentials is centred on technical controls. Users should know how to report a suspicious email, a lost device or an unexpected multi-factor authentication prompt. A fast report can prevent a minor event becoming a serious interruption.
Treat the assessment as a management checkpoint
Before submitting, have someone independent of the person completing the questionnaire review the answers. This may be an internal IT lead, a senior operational owner or an experienced external partner. The purpose is not to make responses sound more favourable. It is to make sure they are precise, consistent and supported by the actual environment.
Certification is not a one-off security project. New staff join, devices are replaced, applications are added and suppliers change. Set a regular review cycle for assets, accounts, patches and security exceptions, then revisit Cyber Essentials readiness ahead of renewal. For organisations that need added assurance, Cyber Essentials Plus can provide independent technical verification, but it should follow sound foundations rather than replace them.
A well-prepared Cyber Essentials submission gives leadership more than a certificate. It creates a clearer picture of who owns security, where risk sits and what needs attention before an avoidable weakness affects the organisation.
