NCSC Cyber Essentials: Requirements for IT Infrastructure

cyber_essentials_3.3

Cyber-Essentialsv3.3

OfficialVerified

The UK National Cyber Security Centre (NCSC) Cyber Essentials scheme - Requirements for IT Infrastructure v3.3 (April 2026). Cyber Essentials organises its technical requirements into five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection. Cloud services are explicitly in scope for Cyber Essentials and cannot be excluded, so under the shared responsibility model this framework covers the controls the applicant organisation is responsible for implementing on its own cloud infrastructure (Infrastructure/Platform as a Service). Requirements that apply to end-user devices, on-premises network appliances, or organisational process and are not observable from cloud control-plane evidence are included for completeness with an empty check list and 'non-applicable' or 'Manual' attributes.

15requirements29checks

Prowler prowler-compliance-cyber-essentials

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler azure --compliance cyber_essentials_3.3

Requirements (15)

CE-FW-01Every device in scope must be protected by a correctly configured firewall or network device with firewall functionality, restricting inbound and outbound network services to those that are secure and necessary.4

Attributes

Theme: Firewalls
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Restrict inbound access from the internet to management and data services (RDP, SSH, database ports) using the provider's network firewall, security group or access-control-list controls, and remove any rule that allows unrestricted inbound access.

CE-FW-03Access to the administrative interface used to manage firewall or network device configuration must not be possible from the internet, unless there is a documented business need and the interface is protected by MFA or an IP allow list combined with a managed password approach.5

Attributes

Theme: Firewalls
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Disable public network access on management-plane resources (object storage, secret and key management services) or restrict access to trusted networks and IP ranges, and require MFA for any administrative access exposed to the internet.

CE-FW-04Firewalls and network devices must block unauthenticated inbound connections by default.5

Attributes

Theme: Firewalls
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: full
Remediation Procedure: Configure network access-control rules with a default-deny inbound posture and only allow specific, documented inbound services. Disable public network access on managed services that do not require it.

CE-SC-01Unnecessary user accounts, such as guest accounts and unused administrative accounts, must be removed or disabled.2

Attributes

Theme: Secure Configuration
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Restrict guest and external user invitations and access, and review identity-provider and cloud role assignments to remove unused guest or administrative accounts.

CE-SC-02Default or guessable account passwords must be changed before a device or service is used.1

Attributes

Theme: Secure Configuration
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable identity-provider security defaults (or an equivalent sign-in protection baseline) so that default or weak credentials cannot be used for sign-in.

CE-SC-05Users must be authenticated before being allowed access to organisational data or services, including cloud services.5

Attributes

Theme: Secure Configuration
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: full
Remediation Procedure: Disable anonymous or public access to object storage and require authenticated, encrypted (TLS 1.2+) access. Use role-based access control for secret and key management data-plane access instead of policies that allow unauthenticated retrieval.

CE-SUM-04Updates that fix vulnerabilities described by the vendor as critical or high risk, or that address a CVSS v3 base score of 7 or above (or where severity is unspecified), must be applied within 14 days of release.2

Attributes

Theme: Security Update Management
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable the provider's security-posture service for system update recommendations and vulnerability assessment, and remediate flagged virtual machines within 14 days of a critical or high-risk update being released. Note: these checks evidence that update monitoring and vulnerability assessment coverage is enabled, not that a given update was applied within the 14-day window, which must be verified from your patch management records.

CE-UAC-02Users must be authenticated with unique credentials before being granted access to applications or devices.2

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable identity-provider security defaults and require every user to authenticate with their own directory-backed identity rather than shared account keys or long-lived access keys when accessing cloud resources such as object storage.

CE-UAC-04Multi-factor authentication must be implemented where available, and authentication to cloud services must always use MFA.5

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: full
Remediation Procedure: Require multi-factor authentication for all users through an enforced sign-in policy, covering administrative consoles, management APIs, and users with access to virtual machines.

CE-UAC-05Separate accounts must be used to perform administrative activities only, with no email, web browsing or other standard user activity that could expose administrative privileges to avoidable risk.3

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Limit the number of highly privileged role assignments (global or organisation administrator), avoid granting owner or access-administrator roles at the account, subscription or project scope, and require named administrators to use dedicated privileged accounts for administrative tasks.

CE-UAC-06Special access privileges must be removed or disabled when they are no longer required, for example when a member of staff changes role.2

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Periodically review identity-provider directory role assignments and cloud role-based access control assignments, removing privileged roles that are no longer needed for a user's current role.

CE-UAC-07Where authentication is carried out using a password, accounts must be protected against brute-force guessing using MFA, attempt throttling, or account lockout.2

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable identity-provider security defaults (which include account lockout on repeated failed sign-ins) and require MFA, particularly for privileged accounts, to mitigate brute-force password attacks.

CE-UAC-08Technical controls must be used to manage the quality of passwords, using MFA, a minimum password length of at least 12 characters with no maximum length, or a minimum of 8 characters combined with a common-password deny list. Regular forced password expiry and complexity requirements should not be enforced.3

Attributes

Theme: User Access Control
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable identity-provider security defaults and password protection (banned or breached password lists), and require MFA so that password length alone is not the only protection.

CE-MP-01A malware protection mechanism must be active on all devices in scope, using anti-malware software, application allow listing, or application sandboxing.3

Attributes

Theme: Malware Protection
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Ensure endpoint protection is installed on all virtual machines and enable the provider's workload protection service for servers, including endpoint detection and response integration.

CE-MP-02Anti-malware software must be kept up to date in line with vendor recommendations, prevent malware from running, prevent execution of malicious code, and prevent connections to malicious websites.3

Attributes

Theme: Malware Protection
References: NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), Section E
Assessment Status: Automated
Cloud Applicability: partial
Remediation Procedure: Enable the provider's workload protection services for endpoints, servers and object storage so that signatures stay current and malicious files, code execution and connections are blocked.