Cyber Essentials for MSPs: how to get a client ready, control by control

To get a client ready for Cyber Essentials, check every computer against the scheme's five technical controls, fix what fails, then answer the questions that no tool can see. Most of the work is finding the one laptop that breaks a rule, so the fastest route is to have every machine checked every day.

This guide walks the five controls in version 3.3 of the requirements, published in April 2026. For each one it says what to check on every machine, what only a person can confirm, and where the time goes. The source throughout is the National Cyber Security Centre's Cyber Essentials pages. If you want the checks run for you, see Cyber Essentials readiness in Helios.

What Cyber Essentials is, in two minutes

Cyber Essentials is the UK government-backed scheme for basic cyber security. An organisation completes a self-assessment. A Certification Body marks it. The certificate lasts twelve months, then the assessment is done again.

Each organisation holds its own certificate. That is why this is client work for an MSP: the solicitor, the accountant and the dental practice each need their own. Many central government contracts require it, and some insurers and larger customers ask for it too.

The requirements sit under five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The assessment covers every device in scope. One machine that fails a rule means the honest answer on the form is no.

Before the controls: agree the scope

The requirements say the assessment "should cover the whole of the IT infrastructure used to carry out your organisation's business". A separately managed sub-set is allowed, but it must be justified to the assessor. Three scope rules catch people out:

• End-user devices are always in. The document says a scope without them "isn't acceptable".
• Cloud services are always in. "Cloud services cannot be excluded from scope."
• Home workers are in. Their work devices count. A router the client supplied counts too. Any other home router is out of scope, so the software firewall on the laptop carries the control.

Your own technicians' machines are usually out of the client's scope. The table in the requirements lists an MSP administrator's device as out of scope unless the client owns it. The accounts you use to manage the client are in scope, because the client owns them.

Start with a list of every computer, with its make, operating system and version. The self-assessment asks for it, and every control below is checked against it.

1. Firewalls

The aim is that only necessary services can be reached from the internet.

Check on every machine:

• The software firewall is on for every network profile. The requirements ask for a software firewall on devices used on untrusted networks, such as public wifi.
• Incoming connections are blocked by default. The wording is "block unauthenticated inbound connections by default".

Only a person can confirm:

• The router's default administrator password has been changed, or remote administration is off.
• The router's admin page cannot be reached from the internet. If it must be, it needs multi-factor authentication or an IP allow list.
• Every inbound rule has been approved and written down, with the business need. Rules nobody needs have been removed.

2. Secure configuration

A new computer is set up to be easy, not safe. This control removes the easy ways in.

Check on every machine:

• The Guest account is off.
• No account is switched on that nobody uses. The requirements name "guest accounts and administrative accounts that won't be used".
• Auto-run is off, so a USB stick cannot start a program by itself.
• Nobody gets in without signing in. That means no automatic sign-in at start-up and no account with a blank password.
• The machine locks after no more than 10 wrong guesses. The alternative is throttling: no more than 10 guesses in 5 minutes.

Only a person can confirm:

• Software nobody needs has been removed.
• Default and guessable passwords have been changed.

A PIN or password used only to unlock a device needs at least 6 characters. If the same credential also signs in to services, the full password rules in control 4 apply.

3. Security update management

This is the control that fails most quietly, because a machine can look healthy for weeks while an update waits.

Check on every machine:

• The operating system is still supported. Software must be "licensed and supported", and removed when it is not.
• No critical or high risk update has waited more than 14 days since release. An update with no stated severity counts too.
• Automatic updates are on "where possible", or your patching tool installs them on a schedule.

Only a person can confirm:

• Phones, tablets, routers and firewalls are supported and updated to the same rule.
• Every application is licensed and still supported by its vendor.

The 14 days run from the vendor's release, not from your approval. A monthly patch cycle with a week of testing can miss it. We wrote about the timing in how fast you should patch.

4. User access control

If someone opens a bad attachment while signed in as an administrator, the malware gets administrator rights. This control limits that.

Check on every machine:

• The person who uses the machine day to day is not an administrator. The requirements ask for "separate accounts to perform administrative activities only", with no email or web browsing on them.

Only a person can confirm:

• There is a process to create and approve accounts, and to remove them when someone leaves.
• Multi-factor authentication is on wherever it is available. For cloud services the rule has no exception: "authentication to cloud services must always use MFA".
• Passwords meet one of three options: multi-factor authentication, at least 12 characters, or at least 8 characters with common passwords blocked by a deny list.

Microsoft 365 will tell you how many people have multi-factor authentication set up. Check that number per client, not once across your whole estate. Our Microsoft 365 security checklist covers the settings behind it.

5. Malware protection

Check on every machine: antivirus is running and its definitions are current. The software must prevent malware from running, prevent malicious code from executing and prevent connections to malicious websites.

The other accepted route is application allow listing, where only approved, signed applications can run. That route suits tightly managed devices.

Where the time goes, by hand and with daily checks

There are twelve machine-level checks in the lists above. By hand, each machine means a remote session, a handful of commands and a note of the answers. Allow ten minutes a machine as a working figure, not a measurement. A 40-computer client is then about seven hours before anything is fixed.

The slower cost is drift. A machine that passed in March can fail in June: a new starter is made an administrator, a firewall profile is switched off to test something, an update stalls. A once-a-year sweep finds that at renewal, when there is least time to fix it.

Daily checks change the shape of the job. The first pass takes minutes, because the readings are already there. The work becomes fixing the failures and answering the questions. Renewal becomes a review of what changed, not a second project.

If you would rather run the checks yourself, the companion piece gives the PowerShell to read and fix each setting. For what is new in this version, see what changed in v3.3.

A sensible order of work for one client

1. Agree the scope and list every device in it.
2. Read every machine against the twelve checks.
3. Fix the settings that can be changed without asking anyone: firewall, auto-run, lockout, the Guest account.
4. Decide the people questions with the client: who keeps administrator rights, which old accounts go.
5. Clear the overdue updates and replace or isolate anything unsupported.
6. Answer the questions for a person: routers, cloud services, account process.
7. Hand the client a readiness report, then they complete the self-assessment.
8. Note the certificate date and start the renewal two months before it runs out.

Where this fits with Helios

Helios checks every Windows machine each day against the twelve checks above. Most of the settings have a one-press fix: the firewall, the inbound block, the Guest account, auto-run, the lockout count, overdue updates and antivirus. Unused accounts and automatic sign-in can be fixed in one press too, after a confirmation.

The questions only a person can answer are saved against the client, with a note. A daily record shows what changed. The certificate's renewal date is tracked. A readiness report goes to the client under your own name.

It is a readiness check, not a certificate. Linux machines report the same settings where they exist on Linux: firewall, accounts, automatic updates, remote sign-in and waiting security updates. On Linux, Fix it covers the firewall, unused accounts and automatic updates. Macs are checked for a supported operating system, overdue updates and antivirus only. It is included in every plan. More detail is on the Cyber Essentials readiness in Helios page.

Questions people ask

Can an MSP get a client Cyber Essentials certified?

An MSP can get a client ready, and many sell that as a service. The certificate itself is awarded by a Certification Body after the client completes the self-assessment.

How long does Cyber Essentials certification last?

Twelve months. The organisation then completes the assessment again against the version of the requirements in force at the time.

Are an MSP's own devices in a client's scope?

Usually not. The requirements list an MSP administrator's device as out of scope unless the client owns it. The accounts the MSP uses to manage the client are in scope, because the client owns them.

How quickly must security updates be installed for Cyber Essentials?

Within 14 days of release, where the update fixes a vulnerability the vendor calls critical or high risk, one with a CVSS v3 base score of 7 or above, or one with no stated severity.