UK Cyber Essentials

UK NCSC: patch management, malware protection, access control, software inventory.


Short name	UK CE
Region	Europe
Country or scope	United Kingdom
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers UK CE

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for UK CE.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for UK CE and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`UK-CE-INV` In-Scope Software Inventory	Organisations must know all software in scope so it can be kept licensed, supported and updated; an enumerated inventory of installed software components is the prerequisite for every other control (Cyber Essentials Requirements for IT Infrastructure, Security Update Management control)	Scan
`UK-CE-PATCH` Security Update Management	All software must be supported and have high/critical security updates applied within 14 days of release, which requires every component's installed version to be recorded and comparable against vendor advisories (Cyber Essentials Requirements for IT Infrastructure, Security Update Management control)	Scan
`UK-CE-VERS` Determinable Software Versions	Patch-currency within the 14-day window can only be assessed when versions are concrete; vague or floating version declarations (latest, wildcards, ranges) make update status unverifiable (Cyber Essentials Requirements for IT Infrastructure, Security Update Management control)	Scan
`UK-CE-SUPPORT` Supported Software from Identifiable Vendors	Software must be licensed and in vendor support; demonstrating support status requires that each component's supplier or publisher is identified (Cyber Essentials Requirements for IT Infrastructure, Security Update Management control)	Scan
`UK-CE-MALWARE` Malware Protection via Trusted Software	The malware protection control permits execution-allow-listing of known, trusted software as an acceptable mechanism, which depends on integrity data (hashes) being available for the deployed components (Cyber Essentials Requirements for IT Infrastructure, Malware Protection control)	Scan
`UK-CE-ID` Unambiguous Asset Identification	Scoping and certification require the assessed estate to be unambiguously identified; components should carry standard identifiers (PURL/CPE) so scheme scope and vulnerability exposure can be established (Cyber Essentials Requirements for IT Infrastructure, scope definition)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CE-BF-1`	Implement Boundary Firewall Controls
`CE-BF-2`	Block Inbound Connections on All Unapproved Ports
`CE-SC-1`	Apply Secure Configuration to All Devices
`CE-SC-2`	Change All Default Administrative Passwords
`CE-AC-1`	Implement User Access Control Based on Least Privilege
`CE-AC-2`	Authenticate Users Before Granting Administrative Access
`CE-AC-3`	Remove or Disable Unused User Accounts
`CE-MP-1`	Deploy and Maintain Malware Protection on All Endpoints
`CE-MP-2`	Restrict Execution of Unauthorised Applications
`CE-PM-1`	Apply Security Patches Within 14 Days of Release
`CE-PM-2`	Remove Unsupported Software from In-Scope Systems
`CE-PM-3`	Maintain Inventory of In-Scope Software and Versions

Policy templates

Written for UK CE:

UK Cyber Essentials Patch Management Policy
UK Cyber Essentials Access Control Policy
UK Cyber Essentials Secure Configuration Policy

And 22 from the standard set, adapted to UK CE.