Step 3 of 7
Secure configuration
Devices and software come set up for convenience, not security. This step is about removing what you don't need and locking down what you keep.
How to do it
Remove unused accounts
Delete or disable old staff accounts, guest accounts and default accounts on every device and in your online services.
Change default passwords
Printers, NAS drives, cameras and admin consoles often ship with a default password. Change every one.
Remove software you don't use
Uninstall trial software, old apps and anything that came pre-installed that nobody needs. Less software means fewer things to keep updated.
Turn off auto-run
Stop USB sticks and downloaded files from running automatically. On Windows, turn off AutoPlay. Macs don't auto-run by default.
Lock every device
Every laptop, phone and tablet needs a PIN, password or fingerprint or face unlock, and should limit failed attempts, for example by locking after 10 wrong guesses.
Use strong passwords
The easiest route is MFA on every account plus a password manager for the team. Without MFA, passwords need at least 12 characters, or at least 8 with common passwords blocked.
Common reasons people get caught out
- Shared logins used by several people
- A printer still on its factory admin password
- Phones with no PIN
Your checklist for this step
- Unused and default accounts removed or disabled
- Default passwords changed on all devices and software
- Software you don't need removed
- Auto-run turned off
- Every device locked with a PIN, password or biometric
- Strong passwords: MFA, or at least 12 characters, or 8 with common passwords blocked
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.