What Does Secure Configuration Mean for Cyber Essentials?

What Does Secure Configuration Mean for Cyber Essentials?

Last updated: 3 October 2026

Secure configuration means setting up your computers, servers, phones and cloud services so they are not left in their weak, out-of-the-box state. Default settings are built for convenience, not security.

It is the second of the five Cyber Essentials technical controls from the National Cyber Security Centre (NCSC), and it is often where small businesses find the most quick wins.

What Cyber Essentials requires

• Unnecessary user accounts removed or disabled, for example accounts belonging to staff who have left.
• Default or easily guessed passwords changed on every device and service.
• Unnecessary software, apps and services removed or disabled.
• Auto-run features that launch files without the user asking switched off.
• Users authenticated before they can reach organisational data or services.
• Devices locked with a password, PIN or biometric, with protection against repeated guessing.

Where businesses most often slip up

• Old leaver accounts that are still active in Microsoft 365 or on the network.
• Pre-installed trial software and unused apps left on new laptops.
• Shared logins that nobody has reviewed for years.
• Devices that can be opened with no screen lock, or with a trivial PIN.

How ABCOM helps

We build a standard secure build for your laptops and servers, remove what you do not need, and clean up accounts and services. That means you start the Cyber Essentials assessment from a clean baseline rather than finding problems halfway through.

This is one of the five Cyber Essentials technical controls. Not sure whether your business would pass? Take our free 4-minute readiness quiz, or book a free cyber security review.