Cyber Essentials and remote access: what the five controls ask for

What Cyber Essentials actually covers

Cyber Essentials is built around five technical control areas: boundary firewalls and internet gateways, secure configuration, security update management, user access control, and malware protection. The scheme has two levels: a self-assessment questionnaire, verified by an external assessor, and Cyber Essentials Plus, which adds hands-on technical testing of the organisation's systems. Both apply to the whole of an organisation's IT that can be reached from the internet, which includes any device or service used for remote access.

Remote access tooling is rarely the headline of a Cyber Essentials assessment, but it sits inside scope wherever it touches an internet-facing device. A remote support agent installed on a laptop, a remote desktop gateway, or a cloud-brokered access service are all part of the estate the five controls are meant to protect.

Firewalls and secure configuration

The firewall control asks whether internet-facing services, including any ports opened for remote access, are restricted to what is actually needed and protected by a properly configured boundary. A remote access product that requires inbound firewall exceptions is a different proposition, from an assessment point of view, to one that only makes outbound connections and brokers the session through a cloud relay, since the latter avoids opening inbound ports altogether.

Secure configuration asks whether default accounts, default passwords and unnecessary functionality have been removed or disabled. For remote access tools this means checking that default admin credentials on any gateway appliance have been changed, that unused remote access protocols are switched off, and that only the features actually in use are enabled.

• Check whether the remote access tool needs inbound firewall rules or only makes outbound connections
• Confirm any gateway or on-premise component has default credentials changed
• Disable legacy remote access protocols that are not actively required

Security update management

This control asks whether software, including operating systems and applications, is kept up to date, with security updates applied within defined timescales and unsupported software removed from use. Remote access clients and agents are a legitimate part of that inventory: an outdated remote support agent with a known vulnerability is exactly the kind of gap Cyber Essentials is designed to close.

Organisations should be able to say how quickly the vendor releases patches for their remote access product, how those updates are delivered, and how quickly they are actually applied across the estate. A vendor with a slow or unclear patching cadence adds risk that the rest of the control set cannot compensate for.

User access control

Cyber Essentials asks that user accounts are only assigned to authorised individuals, that administrative privileges are tightly controlled, and that accounts are removed or disabled when no longer needed. For remote access and remote support tools, this translates directly into a preference for named operator accounts over shared logins, multi-factor authentication on any account that can initiate a session, and a defined process for removing access when a technician or supplier relationship ends.

A tool such as 247connect, which supports named operator accounts and session audit logs, gives an organisation the raw material to answer these questions with evidence rather than assurance. What matters for the assessment is not the brand of tool used but whether the access model and the removal process can actually be demonstrated.

• Named accounts per operator, not shared logins
• Multi-factor authentication enforced for anyone who can start a session
• A documented, timely process for removing leavers' access

Malware protection and Cyber Essentials Plus

Malware protection asks that anti-malware software is installed and kept updated, or that equivalent application allow-listing controls are used. Remote access is relevant here because a compromised support session is one of the routes malware protection is meant to guard against, and file transfer features inside a remote access tool should be covered by the same scanning as any other file movement.

Cyber Essentials Plus goes further, with an independent technical assessment that actually tests configuration rather than taking a questionnaire answer on trust. Organisations preparing for Plus should expect the assessor to look at how remote access is configured in practice, not just how it is described on paper.