Secure configuration is one of the five technical controls at the heart of Cyber Essentials, the UK government-backed scheme designed to protect organisations from the most common cyber threats. While the name might suggest it is purely about settings and policies, secure configuration is really about discipline — ensuring that every device, operating system, and application in your organisation is set up in a way that minimises the attack surface available to an adversary. Assessors look at this control carefully, and it is one of the most frequently failed, largely because organisations underestimate how broadly it applies. It is not just about servers and laptops; it covers every networked device from routers to printers to NAS boxes, and every piece of software installed on them.
Remove What You Do Not Need
The first principle of secure configuration is straightforward: if you do not need it, remove it. Every unnecessary service, protocol, or application is a potential entry point. On Windows machines, this means disabling legacy features such as Telnet and FTP, which transmit credentials in plain text and have no place on a modern network. Use the Windows Features panel to audit what is enabled and disable anything not actively required — SMBv1, for example, is another common culprit that should be disabled on all machines.
The same logic applies to software. Cyber Essentials requires that only software which is needed for the organisation’s work is installed. Trial software that was never uninstalled, legacy tools kept “just in case”, and vendor-installed bloatware all represent unnecessary risk. Conduct a full software audit across every device in scope and uninstall anything that cannot be justified. A clean build with only required software is far easier to secure and maintain than a machine that has accumulated years of unused applications.
Change Every Default Password
This is one of the most common failure points in Cyber Essentials assessments, and it extends far beyond computers and servers. Default credentials are publicly documented by manufacturers and are among the first things an attacker will try. The requirement is clear: every device and application that ships with a default username and password must have those credentials changed before or immediately upon deployment.
This includes routers, managed switches, wireless access points, printers, multifunction devices, NAS (network-attached storage) units, IP cameras, and any other networked hardware. Printers with web-based management interfaces — which is most modern office printers — routinely retain factory defaults because no one thinks to change them. A printer with default credentials on your network is a Cyber Essentials failure, full stop. Create a process for onboarding new devices that includes changing admin passwords as a mandatory first step, and document the credentials securely using a password manager.
Use Only Supported Software and Operating Systems
Cyber Essentials requires that all software in scope is actively supported by its vendor — meaning it receives security patches. Any software or operating system that has reached end of life (EoL) is an automatic failure of this control. There are no exceptions.
This requirement has become particularly significant for UK organisations following the end of life of Windows 10, which Microsoft retired in October 2025. Any organisation that still has Windows 10 machines in scope at their next Cyber Essentials assessment will fail this control. Windows 11 is now the minimum required version for Windows desktops. This is a real and pressing issue for UK SMBs, many of whom delayed their upgrade cycle due to hardware compatibility concerns or the cost of new licences. Windows 11 has more stringent hardware requirements than Windows 10 — notably TPM 2.0 and a compatible processor — meaning some older machines cannot be upgraded and will need to be replaced.
For organisations that need more time to plan their migration, Microsoft offers the Extended Security Update (ESU) programme, which provides continued security patches for Windows 10 beyond its EoL date. ESU is available to businesses and can be purchased through Microsoft or volume licensing channels. It is explicitly intended as a short-term stopgap while migration is planned, not a long-term solution. Assessors are aware of the ESU programme, but relying on it indefinitely is not viable from either a security or a compliance standpoint.
The OS support requirement extends to other platforms. macOS must be running a version released within the last 12 months of the most current release — meaning organisations need to keep pace with Apple’s annual update cycle. iOS and Android devices in scope must similarly be running a version within 12 months of the latest major release from Apple or Google respectively. For servers, the same rule applies: any server OS that has reached EoL must be upgraded or replaced. Windows Server 2012 and 2012 R2, for instance, reached EoL in October 2023 and are a failure if still in use without Extended Security Updates.
Disable Auto-Run Features
Windows AutoPlay and USB auto-run have historically been exploited to execute malicious code the moment a device is connected. Cyber Essentials requires these features to be disabled. On Windows 10 and 11, AutoPlay can be managed through Settings or enforced via Group Policy. The Group Policy setting “Turn off AutoPlay” should be enabled and applied to all drives. This is a straightforward configuration change but one that is frequently overlooked, particularly on machines built without a formal hardening baseline.
Configure Automatic Screen Lock
All devices in scope must be configured to lock automatically after a maximum of 15 minutes of inactivity, and unlocking must require a password or equivalent authentication. This applies to desktops, laptops, mobile devices, and servers with interactive sessions. On Windows, this is managed via Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies. On macOS, screen lock is set through System Preferences under Lock Screen. On mobile devices, the screen timeout and passcode requirement should be enforced through an MDM policy where one is in use.
Achieving Compliance in Practice
The starting point for most organisations is a software and asset audit. For businesses using Microsoft Intune or a device management platform such as Lansweeper, generating a full inventory of installed software and OS versions is straightforward. For smaller businesses without such tooling, a manual spreadsheet audit — listing every device, its OS version, support status, and installed software — is a perfectly valid approach. The key is that you need to know what you have before you can manage it.
Once the audit is complete, cross-reference every OS and application against its vendor’s published support lifecycle. Microsoft publishes lifecycle dates at learn.microsoft.com/lifecycle. Apple, Google, and other vendors publish equivalent pages. Flag anything that has reached EoL and create a remediation timeline. Build a process for reviewing support status on a regular basis — at minimum, annually — so that EoL dates do not catch you by surprise.
Standardising device builds makes ongoing compliance significantly easier. A defined baseline image for Windows or macOS, with unnecessary features disabled, approved software pre-installed, screen lock configured, and AutoPlay off, means that every new device enters the organisation already compliant rather than requiring manual remediation after the fact.
Common Failures to Watch For
- Printers and multifunction devices with unchanged factory admin passwords
- NAS devices running outdated firmware beyond vendor support
- Windows 10 machines still in use following the October 2025 end of life
- Legacy line-of-business applications running on an unsupported OS because the vendor has not released a compatible version
- Trial software or vendor-installed tools that were never removed
- Servers with SMBv1 or Telnet still enabled
- Mobile devices not enrolled in MDM and therefore lacking enforced screen lock policies
Secure configuration is not a one-time task. It requires ongoing attention as software reaches end of life, as new devices join the network, and as operating systems evolve. The organisations that pass this control consistently are those that have built configuration management into their normal IT processes rather than treating it as something to address only in the weeks before an assessment.
Related Cyber Essentials Guides
- Cyber Essentials — The Complete UK Business Guide
- What Is Cyber Essentials? The UK Business Guide
- Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?
- The Five Cyber Essentials Controls Explained
- How to Pass the Cyber Essentials Self-Assessment Questionnaire
Related articles: Business Penetration Testing
