Cyber Essentials readiness
Turn Cyber Essentials tracking on per customer, see how ready each one is, what to fix first, their certificates, and export a readiness report for the customer or an assessor.
Governance and compliance > Cyber Essentials assesses each customer against the current Cyber Essentials requirements for IT infrastructure (v3.3), using what Tenvara already knows: device protection reports, patch management, software updates, known vulnerabilities, hardening baselines, network device logs and Microsoft 365. Nothing needs filling in by hand.
Tracking is something you turn on per customer. A customer has one Cyber Essentials score, and it is the same everywhere it appears: the customer's Cyber Essentials tab (under Compliance on the customer page), its compliance card, the lists, reports and the health score.
Cyber Essentials is part of the Governance and compliance area, beside the other frameworks Tenvara assesses (Essential Eight, NIST CSF 2.0, CIS Controls and NIS2), which share the same checks: see Compliance frameworks.
Turning tracking on
A customer you have not turned Cyber Essentials on for has no score and counts nowhere: not in the lists, reports, health score or alerts. On the customer page, open Compliance, then Cyber Essentials: it shows Track Cyber Essentials for this customer with Turn on.
Turn it on from that card, from the customer's Settings tab (Compliance frameworks, a switch each), from Choose frameworks on the customer's Compliance frameworks tab, or with Track compliance from the start when you create a new customer. Every change is recorded in the customer's activity and the audit log. Turn off asks first and keeps the history.
Once on, a customer shows Waiting for data until something in scope reports: an agent device seen in the last 30 days or a connected Microsoft 365 tenant. Only then is it scored. To have new customers tracked automatically, switch on Track compliance for new customers on the Frameworks and checks tab of Settings > Governance and compliance (off by default).
Adding Cyber Essentials to a management system programme turns it on too: see Management systems overview.
The customer list
The list holds the customers you track. The top of the page counts customers that are Ready (every check passes), At risk (only warnings or unknowns), Not ready (something fails), Certified (with a certificate in date), Expiring soon and Expired. Click a figure to open the matching view. Customers still Waiting for data are counted apart. The Views picker has Not ready, At risk, Ready, Waiting for data, Certified, Certificates expiring and No certificate.
Each customer shows its Readiness, Score out of 100 with its change over the last week, how many checks are Failing and how many are To check, Devices in scope, and what to Fix first. Filter by readiness and certificate state. Checks and scope opens the settings, as does Governance and compliance settings at the bottom of the sidebar.
A customer's assessment
Click a customer to open their assessment. The header shows readiness, the score and how many devices are in scope, with Export PDF. Below:
- What to fix first: automatic fails under the scheme first, then the checks that count most and cover the most devices or accounts.
- The five controls, each with every check, its result and the devices or users behind it with the reason. Users link to their Microsoft 365 account.
- Readiness: the score, counts of failing, to check and passing, and a 90-day trend.
- Certificate: the current certificate and its history.
- Scope: devices in scope, how many report protection, the kinds of device, and the Microsoft 365 accounts and tenants covered.
The assessment is worked out live when you open it, and once a day for the trend. The same score appears on the customer page's Compliance > Cyber Essentials tab and its compliance card, which also shows the readiness (ready, at risk or not ready).
The checks
| Control | Checks |
|---|---|
| Firewalls | Firewall on every device; network devices' admin pages not reachable from the internet (from the network sources' logs) |
| Secure configuration | Guest accounts disabled; default administrator accounts disabled or renamed; AutoRun disabled; SMB version 1 off; screens lock when left (15 minutes); device passwords and lockout; the hardening settings mapped to Cyber Essentials, where a baseline covers them (see Device hardening overview) |
| Security update management | Operating systems still supported (automatic fail); high and critical updates installed within 14 days (automatic fail); applications updated within 14 days; automatic updates on; known vulnerabilities fixed in time |
| User access control | MFA on every Microsoft 365 account (automatic fail); administrators use separate accounts; local administrators within the allowed list |
| Malware protection | Antivirus or EDR on every device; malware signatures up to date |
Known vulnerabilities fixed in time fails when a vulnerability that can be fixed has been open on a device for longer than 14 days and is rated high or critical by its vendor (or, with no vendor rating, scores 7 or more), or is known to be exploited. Only what can actually be installed counts: a vulnerability the vendor has not fixed yet is never late, and neither is one the vendor rates medium however high its CVSS score. Accepted risks do not count, and its fix link opens the customer's Vulnerabilities tab. See Vulnerability priorities, fix states and To do.
Each check is Pass, Fail, Warning (passes, with something to act on soon, such as an operating system leaving support within 60 days), Not known or off. A control fails if any check fails. A customer is Not ready if anything fails, At risk if there are only warnings or unknowns, and Ready otherwise.
Note: MFA on Microsoft 365 accounts is Not known when the customer has no connected tenant or the tenant has no Entra ID P1, because Microsoft does not report MFA registration then. Cloud services cannot be scoped out of Cyber Essentials, so connect the tenant: see Connecting a tenant.
Certificates
Record each certificate once the certifying body issues it:
- Open the customer's assessment and find Certificate.
- Press Add and enter the level (Cyber Essentials or Plus), the certificate number, the certifying body, the issue and expiry dates, and any notes.
The current certificate is the one that expires last. Tenvara raises a reminder alert 30 days before it expires (critical once it has expired), cleared when a newer certificate is added.
Exporting a report
Press Export PDF and choose:
- For the customer: a readiness report in your branding, with what to fix.
- For an assessor, with every item: every check, device and account, and the scope.
The readiness presentation
Once a customer's readiness is scored, Make a presentation on their assessment (and on the customer's Cyber Essentials tab) builds a deck for the conversation about certification: where they stand against the five controls, the gaps that would fail it (automatic fails first), the evidence you already hold, the other frameworks they follow with their scores, and the path to certification with dates and the cost of the work. The devices and accounts behind failing checks stay on a slide for your team only. Present it, publish it or download it as a PDF or an editable PowerPoint file: see Presentations.
Settings
The Cyber Essentials tab of Settings > Governance and compliance (administrators) lists every check, grouped by the five controls. For each you can switch it on or off, set its Weight (1 to 5; automatic fails count three by default) and its limits, such as the screen lock time, minimum password length and lockout, how many days before end of support to warn, and how many days updates may wait.
The same page sets the kinds of device in scope (servers, desktops, laptops and VMs), the list of supported operating systems, and how many days before expiry to remind you. Per customer you can choose their device kinds, devices excluded by agreement, checks switched off (for example the Microsoft 365 check for a Google Workspace customer), and a note shown with the assessment and in the PDF.
Was this page helpful?
Thanks for the feedback.