Cyber Essentials is the UK's baseline certification and increasingly a tender and insurance requirement. If you run Microsoft 365 with managed devices, you can meet every control with settings you already own. Here is the mapping we use.
1. Firewalls
Windows Defender Firewall enforced on all profiles via Intune; macOS firewall on via Jamf, Kandji or Intune. Home routers are out of scope as long as devices are protected by their own firewall.
2. Secure configuration
Default passwords gone, unused software removed, auto-run off, screen lock at 10 minutes or less. Intune Security Baselines cover the lot on Windows; a compliance policy proves it.
3. Security update management
Updates within 14 days of release: Windows Update for Business rings, macOS software update enforcement, and — the one people miss — third-party apps (browsers, Zoom, Adobe) patched through Intune Enterprise App Management or a patching tool.
4. User access control
Unique accounts, MFA on every cloud service, separate admin accounts, leavers removed promptly. This is where Conditional Access and a leaver process matter more than any product.
5. Malware protection
Defender Antivirus or Defender for Business on every device, with real-time protection enforced and reported through Intune.
The three questions people fail
- Are all user accounts protected by MFA — including shared mailboxes and the Xero login?
- Are unsupported operating systems (Windows 10 after October 2025, old iPhones) still in use?
- Are third-party applications patched within 14 days, and can you prove it?
The Cyber Essentials Ready package closes these gaps and completes the self-assessment with you.