Are you closer to
Cyber Essentials than you think?

Does every device that connects to the internet, including ones used from home, sit behind a properly configured firewall?

Have the default admin passwords on your router and firewall been changed from what they shipped with?

When someone new joins, do they get a locked-down standard setup, rather than a copy of whatever was already on the laptop?

Are accounts removed, not just disabled and forgotten, when someone leaves the business?

Are security updates applied automatically, rather than depending on someone remembering to click install?

Do you know whether all the software you use is still supported by its vendor?

Does every person have their own individual login, with none shared between staff?

Is admin-level access limited to only the people who genuinely need it day to day?

Is anti-malware software installed and kept up to date on every device, not just some of them?

Is staff software installation restricted to an approved list, rather than anything goes?