Cyber Essentials
The UK government-backed baseline: five technical controls, self-assessed or Plus-audited.
- Issued by
- NCSC / IASME
- Applies in
- United Kingdom
- Edition
- v3.2 (Willow)
- Area
- Information security
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- FWFirewallsTechnical control
- SCSecure configurationTechnical control
- UACUser access controlTechnical control
- MALMalware protectionTechnical control
- UPDSecurity update managementTechnical control
How Amoreg keeps you on it.
Enable the Cyber Essentials and add NCSC / IASME’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read NCSC / IASME’s pages
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: firewalls
- Rule
- Cyber Essentials, FW
- Area
- Technical control
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
- ISO/IEC 27017 & 27018 — Cloud security and PII in the cloudCloud-specific control guidance and the code of practice for protecting PII in public clouds.Global · 4 controls
- SOC 2 — Trust Services CriteriaSecurity, availability, processing integrity, confidentiality and privacy criteria for service organizations.Global · 8 controls
- SOC 1 / ISAE 3402 — Controls at a service organizationAssurance over controls relevant to user entities' financial reporting — the report fund administrators are asked for.Global · 4 controls
- NIST Cybersecurity Framework 2.0Six functions for managing cybersecurity risk, now including Govern.United States / Global · 6 controls
- CIS Critical Security ControlsPrioritised safeguards in three implementation groups.Global · 8 controls
Also in United Kingdom
- UK Money Laundering Regulations 2017The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.United Kingdom · 8 controls
- JMLSG GuidanceHM Treasury-approved guidance the courts must consider — the practical standard for UK financial sector AML.United Kingdom · 6 controls
- Proceeds of Crime Act 2002 (Part 7)The money laundering offences, the regulated-sector duty to report, and the DAML consent regime.United Kingdom · 4 controls
- UK Sanctions Regime (SAMLA 2018 / OFSI)The Sanctions and Anti-Money Laundering Act 2018 regulations and OFSI reporting, licensing and enforcement expectations.United Kingdom · 5 controls
- Legal Sector Affinity Group AML GuidanceHM Treasury-approved guidance for law firms and independent legal professionals under the MLR 2017.United Kingdom · 5 controls
- CCAB AML Guidance for the Accountancy SectorAMLGAS — the approved guidance for accountants, auditors, tax advisers and insolvency practitioners.United Kingdom · 5 controls
Questions
Does Amoreg watch for changes to the Cyber Essentials?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the Cyber Essentials?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records v3.2 (Willow). Editions were last verified in August 2026, and the Monitor records new publications as they appear.