Cyber Essentials for AWS: what assessors ask for

Published 2026-10-24, updated 2026-11-05

Cyber Essentials is the UK government-backed baseline for security, and more customers and public-sector contracts ask for it every year. Its five controls were written with offices in mind, but they apply to cloud services too, and the assessment now asks about them directly. Here's what each one means for an AWS account, and the evidence that shows it.

This guide is general information, not an assessment. Your certification body decides what it accepts.

1. Firewalls

In AWS your firewall is the security group (and network ACLs). The question is whether anything is open to the whole internet that shouldn't be.

• No security group should allow SSH (22), RDP (3389) or database ports from 0.0.0.0/0 or ::/0.
• Databases shouldn't be publicly accessible.
• Evidence: a list of security groups open to the internet (ideally none, or only 80 and 443 on load balancers), dated.

This lists the security groups with a rule open to the whole internet, in one region. Check each rule's ports, and repeat for every region you use:

aws ec2 describe-security-groups \
  --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query 'SecurityGroups[].[GroupId,GroupName]' --output table

2. Secure configuration

Remove what you don't need, and turn on the safe defaults.

• Default EBS encryption on in every region; storage and databases encrypted.
• S3 Block Public Access on for the account, and no public buckets, snapshots or images unless intended.
• Instance metadata service version 2 (IMDSv2) required.
• Unused resources removed (a forgotten server is an unpatched server).

3. User access control

This is where assessors spend the most time, and where AWS accounts most often fall short. Sign-in to cloud services must use MFA, and leaving it off where it's available now fails the assessment.

• MFA on the root user, and the root user not used day to day.
• MFA on every IAM user who can sign in to the console (or, better, single sign-on with MFA instead of IAM users).
• Admin rights only for people who need them, separate from their everyday access.
• Leavers removed promptly, including their access keys.
• Regular access reviews: a dated list of who can get in, checked and signed off.
• Evidence: the IAM credential report, the list of admins, and your last access review.

4. Malware protection

For AWS, this usually means threat detection and keeping workloads to approved software: Amazon GuardDuty switched on in every region you use, and alerts going to someone who reads them.

5. Security update management

• Critical and high-risk fixes applied within 14 days of release: a CVSS score of 7 or above, rated critical or high by the vendor, or with no rating given.
• Lambda functions on supported runtimes; databases off engine versions in extended support.
• Instances patched (Systems Manager Patch Manager, or replaced from fresh images).
• Certificates and domains renewed before they expire.

Logging: the control behind the controls

Cyber Essentials doesn't list it separately, but you can't show any of the above without it: CloudTrail recording in every region, kept somewhere it can't be quietly deleted.

Turning it into evidence

Assessors and customers' security questionnaires want the same thing: each question answered, with proof and a date. Keep a short document per control, updated when you change something, rather than rebuilding it the week of the assessment.