UK Cyber Essentials

United Kingdom

6 domains

36 controls

NCSC Cyber Essentials + Cyber Essentials Plus. UK government-backed cybersecurity certification.

Verified

UK Cyber Essentials is a compliance framework from United Kingdom with 6 domains and 36 controls that map to 23 other frameworks. The largest domains are Secure Configuration (9 controls), User Access Control (8 controls), Firewalls (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Firewalls

7 controls

Controls in the Firewalls domain of UK Cyber Essentials — 7 controls
Code	Title	Description
CE-FW.1	Boundary Firewalls Deployed	Every device in scope must be protected by a correctly configured firewall (or network device with firewall functionalit...
CE-FW.2	Change Default Firewall Passwords	Change all default administrative passwords on boundary firewalls to a non-guessable password, or disable remote admin a...
CE-FW.3	Block Unauthenticated Inbound Connections	Prevent access to firewall administrative interface from the internet unless protected by MFA or IP allowlist limited to...
CE-FW.4	Approve and Document Inbound Rules	Every inbound firewall rule that permits traffic must be approved and documented by an authorised individual with docume...
CE-FW.5	Remove or Disable Unused Rules	Remove or disable permissive firewall rules promptly when no longer required to limit attack surface.
CE-FW.6	Host-Based Firewall for Remote Workers	Where devices are used on untrusted networks (home, public Wi-Fi), the host-based software firewall must be enabled and...
CE-FW.7	Restrict Firewall Administrative Interface from the Internet	Block internet access to the firewall administrative interface unless there is a clear documented business need, and whe...

Malware Protection

4 controls

Controls in the Malware Protection domain of UK Cyber Essentials — 4 controls
Code	Title	Description
CE-MP.1	Anti-Malware Software Deployed	Implement anti-malware on all in-scope devices: anti-malware software (signature/heuristic), application allowlisting, o...
CE-MP.2	Anti-Malware Signatures Updated	Where anti-malware software is used, it must be kept up to date with the latest signatures and engine updates.
CE-MP.3	Anti-Malware Scans Files on Access and Web Pages	Anti-malware software must scan files automatically on access, scan web pages when accessed, and prevent connections to...
CE-MP.4	Application Allowlisting (Alternative)	Where allowlisting is used instead of AV, only approved applications (signed or hash-listed) can execute. List must be a...

Scope

3 controls

Controls in the Scope domain of UK Cyber Essentials — 3 controls
Code	Title	Description
CE-SCOPE.1	Scope Definition	Define the scope of certification covering all end user devices, servers, networks, cloud services, and remote workers....
CE-SCOPE.2	Cloud Services in Scope	All cloud services (IaaS, PaaS, SaaS) used by the organisation must be in scope and the applicant retains responsibility...
CE-SCOPE.3	BYOD and Home Working	User-owned devices accessing organisational data or services are in scope. Home routers provided by ISP are out of scope...

Secure Configuration

9 controls

Controls in the Secure Configuration domain of UK Cyber Essentials — 9 controls
Code	Title	Description
CE-SC.1	Remove or Disable Unused Software	Remove or disable unnecessary user accounts, software, and services on devices to reduce the attack surface.
CE-SC.2	Change Default Passwords on Devices and Software	Change any default passwords on devices and software before deployment, or remove the account if not needed.
CE-SC.3	Disable Auto-Run Features	Disable auto-run or auto-play features that automatically execute code without user authorisation on removable media or...
CE-SC.4	Authenticate Users Before Access	Authenticate users with a unique credential before granting access to applications and devices. Auto-logon must be disab...
CE-SC.5	Password-Based Authentication Quality	Where passwords are the only factor, protect against brute force by lockout (max 10 attempts in 5 min), throttling, or b...
CE-SC.6	Multi-Factor Authentication for Cloud Services	MFA must be applied to all administrative accounts on cloud services and to all user accounts on cloud services where su...
CE-SC.7	Educate Users on Strong Passwords	Educate users to avoid common, predictable, or compromised passwords and on the importance of unique passwords per accou...
CE-SC.8	Process for Compromised Passwords	Have a process to change passwords promptly when the user knows or suspects the password or account has been compromised...
CE-SC.9	Device Unlocking Credentials and Brute-Force Protection	Require a biometric, password or PIN before a physically present user reaches device services, protect that credential a...

Security Update Management

5 controls

Controls in the Security Update Management domain of UK Cyber Essentials — 5 controls
Code	Title	Description
CE-SU.1	Software Licensed and Supported	All software on in-scope devices must be licensed and supported by the vendor (i.e. receiving security updates). Unsuppo...
CE-SU.2	Automatic Updates Enabled Where Possible	Automatic updates must be enabled on devices and software where the option exists, to ensure security updates are applie...
CE-SU.3	Critical and High Updates within 14 Days	All high or critical security updates (CVSS 7.0+ or vendor critical/high rating) must be applied within 14 days of relea...
CE-SU.4	Remove Out-of-Support Software	Remove software that is no longer receiving security updates from in-scope devices, or fully segregate it from the rest...
CE-SU.5	Firmware Updates	Firmware on routers, firewalls and other in-scope network devices must be kept current. Firmware is treated as software...

User Access Control

8 controls

Controls in the User Access Control domain of UK Cyber Essentials — 8 controls
Code	Title	Description
CE-AC.1	User Account Approval Process	Have a documented user account creation and approval process. All accounts must be approved by an authorised individual...
CE-AC.2	Authenticate Users Before Granting Access	Authenticate users with a unique account and password (or other credential) before granting access to applications or de...
CE-AC.3	Remove or Disable Accounts When No Longer Required	Remove or disable user accounts when they are no longer required (leaver, role change, extended leave) within a defined...
CE-AC.4	Privileged Account Approval and Tracking	Implement an approval process and keep track of privileged (administrative) accounts. The granting of privileges must be...
CE-AC.5	Separate Admin Accounts for Administrative Activities	Use separate accounts to perform administrative activities only. Admin accounts must not be used for routine activities...
CE-AC.6	Periodic Review of Privileged Access	Review user accounts with special access privileges on a regular basis and remove or downgrade where no longer needed.
CE-AC.7	MFA for Administrative Accounts	Multi-factor authentication must be enabled for all administrative accounts on cloud services and where technically feas...
CE-AC.8	Passwordless Authentication	Where identity is established without a password, use a recognised passwordless method such as a FIDO2 authenticator or...

Your Compliance Coverage

If you comply with UK Cyber Essentials, you already cover:

C5 (Germany)

100%

36 controls mapped

Compare →

NIST SP 800-171 Rev 3

100%

36 controls mapped

Compare →

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

100%

36 controls mapped

Compare →

+ 20 more: FedRAMP Moderate (100%), FedRAMP High (100%)

See all 23 mapped frameworks ↓

Maps to 23 other frameworks

36 total controls

C5 (Germany)

36 source controls mapped|32 target controls covered

100%

NIST SP 800-171 Rev 3

36 source controls mapped|36 target controls covered

100%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

36 source controls mapped|33 target controls covered

100%

FedRAMP Moderate

36 source controls mapped|60 target controls covered

100%

FedRAMP High

36 source controls mapped|60 target controls covered

100%

NIST SP 800-53 Rev 5 MODERATE

34 source controls mapped|45 target controls covered

94%

NIST SP 800-53 Revision 5.1 HIGH

34 source controls mapped|45 target controls covered

94%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

34 source controls mapped|26 target controls covered

94%

NIST SP 800-161 Rev 1

34 source controls mapped|24 target controls covered

94%

Azure Security Benchmark

33 source controls mapped|35 target controls covered

92%

NIST SP 800-53 Rev 5 LOW

32 source controls mapped|28 target controls covered

89%

ASD Strategies to Mitigate Cyber Security Incidents

31 source controls mapped|24 target controls covered

86%

ISO 27001:2022

31 source controls mapped|21 target controls covered

86%

ISO 27002:2022

31 source controls mapped|21 target controls covered

86%

NIST SP 800-53 Rev 5

31 source controls mapped|33 target controls covered

86%

CMMC 2.0

30 source controls mapped|40 target controls covered

83%

CIS Controls v8

29 source controls mapped|44 target controls covered

81%

NIST Cybersecurity Framework 2.0

28 source controls mapped|16 target controls covered

78%

PCI DSS 4.0

28 source controls mapped|44 target controls covered

78%

AWS Well-Architected Security Pillar

25 source controls mapped|19 target controls covered

69%

HIPAA Security Rule

25 source controls mapped|20 target controls covered

69%

NIST SP 800-66 Rev 2

25 source controls mapped|20 target controls covered

69%

SOC 2

19 source controls mapped|9 target controls covered

53%

Compare UK Cyber Essentials with C5 (Germany)

What is UK Cyber Essentials and who does it apply to?

UK Cyber Essentials is a compliance framework from United Kingdom with 6 domains and 36 controls. NCSC Cyber Essentials + Cyber Essentials Plus. UK government-backed cybersecurity certification. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does UK Cyber Essentials actually require?

UK Cyber Essentials has 36 controls organised across 6 domains. The largest domains are Secure Configuration (9 controls), User Access Control (8 controls), Firewalls (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of UK Cyber Essentials do I already cover?

UK Cyber Essentials maps to 23 other compliance frameworks. The top mapping partners are C5 (Germany) (100% coverage), NIST SP 800-171 Rev 3 (100% coverage), Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement UK Cyber Essentials?

Start your UK Cyber Essentials compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Cyber Essentials requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 36 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required