Beyond SOC 2
What are the 5 controls of Cyber Essentials?
What are the 5 controls of Cyber Essentials?
The five Cyber Essentials controls are firewalls, secure configuration, user access control, malware protection, and security update management. Cyber Essentials is a UK government-backed scheme run by the National Cyber Security Centre, and the five were chosen because together they block the large majority of commodity internet attacks. All five are technical; the scheme deliberately contains no governance requirements.
The five controls
| Control | What it requires |
|---|---|
| Firewalls | Boundary firewalls and correctly configured device firewalls between your network and the internet |
| Secure configuration | Remove or disable unnecessary accounts, software, and services; change default passwords |
| User access control | Accounts assigned to individuals, admin rights granted only where needed and reviewed |
| Malware protection | Anti-malware, application allow-listing, or sandboxing on in-scope devices |
| Security update management | Supported software only, with high and critical patches applied within 14 days |
Cyber Essentials and Cyber Essentials Plus
The controls are the same. The difference is verification.
- Cyber Essentials is a self-assessment questionnaire, reviewed and verified by a certification body.
- Cyber Essentials Plus adds hands-on technical testing by an assessor, including vulnerability scanning across a sample of devices.
Plus takes longer and costs more, and it is what a buyer who cares about the difference will ask for.
Where it stops
The scheme's narrowness is intentional and it is also its limit. Cyber Essentials says nothing about:
- Risk assessment and treatment
- Policies, governance, or management accountability
- Vendor and third-party risk
- Incident response and business continuity
- Personnel security, training, or background checks
- Evidence that controls operated over a period rather than on the assessment date
That last one is the structural difference from SOC 2 Type II. Cyber Essentials certifies a point in time. A Type II report tests whether controls operated throughout an observation period.
When it is the right answer
| Situation | Better fit |
|---|---|
| Bidding for UK public sector contracts | Cyber Essentials, often mandatory |
| Small UK company wanting a credible first step | Cyber Essentials |
| US enterprise buyer asking for assurance | SOC 2 |
| International enterprise or tender requiring a certificate | ISO 27001 |
| Healthcare data in the US | HIPAA, usually alongside SOC 2 |
Cyber Essentials is a reasonable place to start and a poor place to stop if your buyers are enterprises. The five controls map onto parts of SOC 2 CC6 and CC7 and onto several ISO 27001 Annex A controls, so the work is not wasted when you move up.