The five core controls are:
Boundary Firewalls & Internet Gateways | Secure Configurations | Access Controls | Malware Protection | Security Updates
However, due to the complexity and ever-evolving nature of the threat landscape, not all of the Cyber Essentials requirements fit neatly into these five controls. The reason for this is the scheme's aim being to keep organisations protected against the most common cyber attacks, which can only be achieved if the NCSC and IASME regularly revise the criteria as a defence against emerging threats.
