UK Cyber Essentials: the evidence behind each requirement
36 requirements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
The version of the requirements is not stamped here; check the question set your certification body uses.
User Access Control
AC.1User Account Approval Process moderateAC.2Authenticate Users Before Granting Access easyAC.3Remove or Disable Accounts When No Longer Required easyAC.4Privileged Account Approval and Tracking moderateAC.5Separate Admin Accounts for Administrative Activities easyAC.6Periodic Review of Privileged Access moderateAC.7MFA for Administrative Accounts moderateAC.8Passwordless Authentication easyFirewalls
FW.1Boundary Firewalls Deployed easyFW.2Change Default Firewall Passwords easyFW.3Block Unauthenticated Inbound Connections easyFW.4Approve and Document Inbound Rules moderateFW.5Remove or Disable Unused Rules easyFW.6Host-Based Firewall for Remote Workers easyFW.7Restrict Firewall Administrative Interface from the Internet moderateMalware Protection
MP.1Anti-Malware Software Deployed hardMP.2Anti-Malware Signatures Updated easyMP.3Anti-Malware Scans Files on Access and Web Pages hardMP.4Application Allowlisting (Alternative) hardSecure Configuration
SC.1Remove or Disable Unused Software hardSC.2Change Default Passwords on Devices and Software hardSC.3Disable Auto-Run Features easySC.4Authenticate Users Before Access moderateSC.5Password-Based Authentication Quality easySC.6Multi-Factor Authentication for Cloud Services easySC.7Educate Users on Strong Passwords moderateSC.8Process for Compromised Passwords hardSC.9Device Unlocking Credentials and Brute-Force Protection easyScope
SCOPE.1Scope Definition easySCOPE.2Cloud Services in Scope moderateSCOPE.3BYOD and Home Working easy