Cyber Essentials readiness checklist for UK SMEs
What assessors actually check
Cyber Essentials certifies five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. The audit is not looking for perfection — it is looking for evidence that each control exists, is configured, and is maintained.
Most failures are not exotic. They are a forgotten admin account, a laptop two patches behind, or a firewall rule nobody can explain.
The five controls, in plain English
- Firewalls — every device and network boundary has one, enabled and documented
- Secure configuration — default passwords changed, unused services removed
- User access control — named accounts, least privilege, MFA on email and admin
- Malware protection — endpoint protection deployed and reporting centrally
- Patch management — critical updates applied within 14 days
The mistakes that fail audits
The most common failure is stale evidence: a screenshot from six months ago, or a policy that names a person who has left. Assessors want current proof, not historic intention.
Second is scope confusion — a personal device used for work email that never made it into scope. List every device that touches company data before you start.
How to evidence everything in a week
Day one: inventory devices and accounts. Day two: close the obvious gaps — MFA, patching, default passwords. Day three: capture evidence screenshots with dates. Day four: write the one-page policies. Day five: internal review against the question set.
Aura's Cyber Essentials readiness engagement runs exactly this process with you — scoping, gap-fixing and evidence packs — so the assessment itself becomes a formality.