UK Cyber Essentials: every control, and what you already have

36 controls 23 frameworks share controls with it United Kingdom verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

UK Cyber Essentials Evidence & Implementation Kit

36 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
C5 (Germany)	36	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	36	measure it →
FedRAMP High	36	measure it →
FedRAMP Moderate	36	measure it →
NIST SP 800-171 Rev 3	36	measure it →
ANSSI Guide d'hygiene informatique (42 mesures, v2.0)	34	measure it →
NIST SP 800-161 Rev 1	34	measure it →
NIST SP 800-53 Rev 5 MODERATE	34	measure it →
NIST SP 800-53 Revision 5.1 HIGH	34	measure it →
Azure Security Benchmark	33	measure it →
NIST SP 800-53 Rev 5 LOW	32	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	31	measure it →

Every control

Code	Control	Also in
`CE-AC.1`	User Account Approval Process	23
`CE-AC.2`	Authenticate Users Before Granting Access	22
`CE-AC.3`	Remove or Disable Accounts When No Longer Required	23
`CE-AC.4`	Privileged Account Approval and Tracking	23
`CE-AC.5`	Separate Admin Accounts for Administrative Activities	21
`CE-AC.6`	Periodic Review of Privileged Access	22
`CE-AC.7`	MFA for Administrative Accounts	23
`CE-AC.8`	Passwordless Authentication	16
`CE-FW.1`	Boundary Firewalls Deployed	23
`CE-FW.2`	Change Default Firewall Passwords	16
`CE-FW.3`	Block Unauthenticated Inbound Connections	17
`CE-FW.4`	Approve and Document Inbound Rules	19
`CE-FW.5`	Remove or Disable Unused Rules	15
`CE-FW.6`	Host-Based Firewall for Remote Workers	22
`CE-FW.7`	Restrict Firewall Administrative Interface from the Internet	12
`CE-MP.1`	Anti-Malware Software Deployed	22
`CE-MP.2`	Anti-Malware Signatures Updated	22
`CE-MP.3`	Anti-Malware Scans Files on Access and Web Pages	23
`CE-MP.4`	Application Allowlisting (Alternative)	19
`CE-SC.1`	Remove or Disable Unused Software	23
`CE-SC.2`	Change Default Passwords on Devices and Software	22
`CE-SC.3`	Disable Auto-Run Features	15
`CE-SC.4`	Authenticate Users Before Access	17
`CE-SC.5`	Password-Based Authentication Quality	22
`CE-SC.6`	Multi-Factor Authentication for Cloud Services	19
`CE-SC.7`	Educate Users on Strong Passwords	19
`CE-SC.8`	Process for Compromised Passwords	21
`CE-SC.9`	Device Unlocking Credentials and Brute-Force Protection	18
`CE-SCOPE.1`	Scope Definition	22
`CE-SCOPE.2`	Cloud Services in Scope	21
`CE-SCOPE.3`	BYOD and Home Working	17
`CE-SU.1`	Software Licensed and Supported	20
`CE-SU.2`	Automatic Updates Enabled Where Possible	20
`CE-SU.3`	Critical and High Updates within 14 Days	21
`CE-SU.4`	Remove Out-of-Support Software	18
`CE-SU.5`	Firmware Updates	16

Tell me when UK Cyber Essentials files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Annual review records
Approval record
KB articles
Documentation standards
Review cycles
IT strategy doc

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No review cadence named by 7 frameworks

What this page is

A control-level reference for UK Cyber Essentials, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition