Cyber Essentials Plus Checklist

Firewalls create a barrier between your network and other, external networks. For all firewalls (or equivalent network devices), you must:

• Change any default administrative password to a strong alternative or disable remote administrative access entirely;
• Prevent access to the administrative interface from the Internet, unless there is a clear and documented business need, in which case you must protect the interface with one of the following controls:
  • An additional authentication factor, such as an OTP (one-time password).
  • An IP whitelist that limits access to a small range of trusted addresses.
• Block unauthenticated inbound connections by default;
• Ensure inbound firewall rules are approved and documented, along with the business need for each rule, by an authorised individual;
• Remove or disable permissive firewall rules as soon as they are no longer needed; and
• Use a host-based firewall on devices that are used on public or other untrusted networks.

  Learn more about firewalls and gateways

Secure configuration refers to selecting the most secure settings or configurations when installing computers and network devices to minimise inherent vulnerabilities and provide the minimum amount of access necessary to fulfil their role. You must routinely:

• Remove and disable unnecessary user accounts;
• Change default or guessable account passwords to a strong alternative;
• Remove or disable unnecessary software;
• Disable any auto-run feature that allows file execution without user authorisation; and
• Authenticate users before allowing access to organisational data or services.

In addition, physically present users must use appropriate device locking controls.

  Learn more about secure configuration

Good user access control ensures that only authorised individuals have a user account, which gives them the minimum amount of access necessary to perform their duties. You must:

• Have a user account creation and approval process;
• Authenticate users, using unique credentials, before granting them access to applications or devices;
• Remove or disable user accounts when no longer required;
• Use or implement MFA (multifactor authentication) where available, and always authenticate to Cloud services using MFA;
• Use administrative accounts to perform administrative activities only; and
• Remove or disable special access privileges when no longer required.

  Learn more about access control

Malware protection ensures that harmful or untrusted software cannot execute on your systems, potentially compromising them or the data they hold. For all in-scope devices, you must use at least one of anti-malware software, whitelisting or sandboxing.

If you use anti-malware software, you must:

• Keep it up to date, with signature files updated at least daily;
• Configure it to scan files automatically upon access, whether accessed from a network folder or downloaded and opened;
• Have it scan web pages automatically when accessed through a web browser; and
• Have it prevent connections to malicious websites, unless you have a clear, documented business need to access them, and understand and accept the associated risk.

If you whitelist, ensuring that only actively approved applications can execute on devices, you must:

• Maintain an up-to-date list of approved applications; and
• Prevent users from installing applications that are unsigned or have an invalid signature.

With sandboxing, you ensure all code of unknown origin is first run in a sandbox to prevent it from accessing other resources on your network unless a user explicitly allows otherwise. If you use sandboxing, the other resources to protect include:

• Other sandboxed applications;
• Data stores;
• Sensitive peripherals (such as cameras and microphones); and
• Local network access.

  Learn more about malware protection

Keeping devices and software up to date – for example, by installing patches – will ensure they are not vulnerable to any known security issues, including newly discovered ones. All software on in-scope devices must be:

• Licensed and supported;
• Removed from devices when no longer supported;
• Enabled for automatic updates where possible; and
• Patched within 14 days of an update being released in cases where it:
  • Fixes a vulnerability the vendor describes as ‘critical’ or ‘high risk’;
  • Fixes a vulnerability with a CVSS (Common Vulnerability Scoring System) v3 score of at least 7; and
  • Fixes a vulnerability of unknown risk.

  Learn more about security update management