Cyber Essentials and UK GDPR checklist

Before you start: what's in scope

Cyber Essentials covers everything your business uses to work, including personal devices used for work email.

• List every laptop, desktop, phone and tablet used for work, with its operating system and version.Check which devices are still supported
• List the cloud services you use, such as Microsoft 365, Google Workspace, Xero or your booking system.
• Decide whether you're certifying the whole organisation. You need to for the included cyber insurance.

1. Firewalls

Stop unwanted connections reaching your devices from the internet.

• Every laptop and desktop has its firewall switched on. The ones built into Windows and macOS are fine.
• Your office router's admin password has been changed from the default to a strong, unique one.
• The router's admin page can't be reached from the internet, and no ports are opened that you don't need.

2. Secure configuration

Set devices and accounts up safely, and remove what you don't use.

• Software, apps and user accounts nobody uses have been removed or disabled.
• All default passwords on devices and services have been changed.
• Passwords are at least 12 characters, or at least 8 with two-step verification switched on.
• Every device locks with a PIN, password, fingerprint or face, and locks automatically when left.
• Auto-run is turned off, so files from USB sticks and downloads don't open by themselves.

3. Security update management

Keep everything supported and up to date.

• Every operating system and app is licensed and still gets security updates from its maker.Windows support dates
• Automatic updates are switched on wherever possible.
• High-risk and critical security updates are installed within 14 days of release.
• Unsupported software and devices have been removed, replaced or taken out of scope.

4. User access control

Make sure only the right people can get in, with only the access they need.

• Everyone has their own account. No shared logins.
• Admin accounts are separate from everyday accounts, and only used for admin tasks.
• Two-step verification is switched on for every cloud service that offers it. Since April 2026, missing it is an automatic fail.How to switch it on
• Accounts are removed or disabled on a person's last day, and access is reviewed regularly.

5. Malware protection

Stop harmful software running on your devices.

• Every laptop and desktop has antivirus switched on and up to date. Microsoft Defender and the protection built into macOS count.
• Phones and tablets only install apps from the official app stores.

UK GDPR basics

The data protection essentials for a small business or charity.

• You've paid the ICO data protection fee, or checked that you're exempt.ICO fee checker
• You have a privacy notice that explains what personal information you collect and why.
• You have a record of the personal information you hold, where it's kept and who can see it.
• You know how long you keep each type of information, and delete it on schedule.
• You have a breach plan, and know serious breaches must be reported to the ICO within 72 hours.
• You have a data protection complaints procedure and acknowledge complaints within 30 days.The 2026 complaints rules
• Suppliers who handle personal information for you have a contract that covers data protection.

Good practice beyond Cyber Essentials

Not part of the certificate, but insurers and clients often ask.

• Important data is backed up automatically, with one copy kept separate from your main systems, and you've tested a restore.
• Staff know how to spot scam emails and fake bank detail changes.Free staff phishing training
• You have a short plan for what to do if you're hacked, and who to call.
• Your email domain has SPF and DMARC records, so others can't easily send email as you.Email spoofing check

This checklist is a plain-English readiness guide based on the NCSC's Cyber Essentials requirements (v3.3, from April 2026) and the ICO's guidance for small organisations. It isn't the official question set, and Brightlock Cyber doesn't issue Cyber Essentials certificates. Your ticks are saved only in this browser.

Brightlock Cyber free checklist. Get your score, step-by-step fixes and your compliance pack at Brightlock Cyber.