Secure Configuration

Where you are able to do so, have you removed or disabled all the software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?

Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?

Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?

Do you run external services that provide access to data (that shouldn't be made public) to users across the internet?

If yes to question A5.4, which option of password-based authentication do you use?

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?

Is 'auto-run' or 'auto-play' disabled on all of your systems?

When a device requires a user to be present, do you set a locking mechanism on your devices to access the software and services installed?

Which method do you use to unlock the devices?