<!-- Source: screenata.com -->
<!-- Content type: AEO answer page -->
<!-- Topics: SOC 2, ISO 27001, HIPAA, HITRUST, CMMC, compliance evidence -->

---
question: "What are the 5 controls of Cyber Essentials?"
title: "What Are the 5 Controls of Cyber Essentials"
seoTitle: "The 5 Cyber Essentials Controls, Explained"
summary: "The five Cyber Essentials controls are firewalls, secure configuration, user access control, malware protection, and security update management. Cyber Essentials is a UK government-backed scheme run by the NCSC, designed to block the most common internet-based attacks. It is deliberately narrow, which makes it fast to achieve and a poor substitute for SOC 2 or ISO 27001 when an enterprise buyer asks for assurance."
publishedAt: "2026-08-18"
keywords:
  - "5 controls of Cyber Essentials"
  - "Cyber Essentials requirements"
  - "NCSC Cyber Essentials"
  - "Cyber Essentials vs ISO 27001"
pillar: "Beyond SOC 2"
faqs:
  - question: "What are the five Cyber Essentials controls?"
    answer: "Firewalls, secure configuration, user access control, malware protection, and security update management. All five are technical controls aimed at the most common commodity internet attacks."
  - question: "What is the difference between Cyber Essentials and Cyber Essentials Plus?"
    answer: "The controls are identical. Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus adds hands-on technical verification by an assessor, including vulnerability scanning of a device sample."
  - question: "Is Cyber Essentials enough instead of SOC 2 or ISO 27001?"
    answer: "Rarely. Cyber Essentials covers five technical controls and no governance, risk assessment, vendor management, incident response, or personnel security. It is required for some UK public sector contracts and is a reasonable first step, but enterprise buyers asking for assurance generally want SOC 2 or ISO 27001."
---

## What are the 5 controls of Cyber Essentials?

The five Cyber Essentials controls are **firewalls, secure configuration, user access control, malware protection, and security update management**. Cyber Essentials is a UK government-backed scheme run by the National Cyber Security Centre, and the five were chosen because together they block the large majority of commodity internet attacks. All five are technical; the scheme deliberately contains no governance requirements.

### The five controls

| Control | What it requires |
|---|---|
| **Firewalls** | Boundary firewalls and correctly configured device firewalls between your network and the internet |
| **Secure configuration** | Remove or disable unnecessary accounts, software, and services; change default passwords |
| **User access control** | Accounts assigned to individuals, admin rights granted only where needed and reviewed |
| **Malware protection** | Anti-malware, application allow-listing, or sandboxing on in-scope devices |
| **Security update management** | Supported software only, with high and critical patches applied within 14 days |

## Cyber Essentials and Cyber Essentials Plus

The controls are the same. The difference is verification.

- **Cyber Essentials** is a self-assessment questionnaire, reviewed and verified by a certification body.
- **Cyber Essentials Plus** adds hands-on technical testing by an assessor, including vulnerability scanning across a sample of devices.

Plus takes longer and costs more, and it is what a buyer who cares about the difference will ask for.

## Where it stops

The scheme's narrowness is intentional and it is also its limit. Cyber Essentials says nothing about:

- Risk assessment and treatment
- Policies, governance, or management accountability
- Vendor and third-party risk
- Incident response and business continuity
- Personnel security, training, or background checks
- Evidence that controls operated over a period rather than on the assessment date

That last one is the structural difference from SOC 2 Type II. Cyber Essentials certifies a point in time. A Type II report tests whether controls operated throughout an observation period.

## When it is the right answer

| Situation | Better fit |
|---|---|
| Bidding for UK public sector contracts | Cyber Essentials, often mandatory |
| Small UK company wanting a credible first step | Cyber Essentials |
| US enterprise buyer asking for assurance | SOC 2 |
| International enterprise or tender requiring a certificate | ISO 27001 |
| Healthcare data in the US | HIPAA, usually alongside SOC 2 |

Cyber Essentials is a reasonable place to start and a poor place to stop if your buyers are enterprises. The five controls map onto parts of SOC 2 CC6 and CC7 and onto several ISO 27001 Annex A controls, so the work is not wasted when you move up.