Compliance & Certification

Step-by-step instructions and resources to help you generate compliance evidence, prepare for audits, and meet regulatory requirements.

• Access Request Process Guide

  1. Purpose of this Guide This artefact shows that your company has a clear and controlled way to grant, change, and revoke access to...

• Account Inventory List Guide

  1. Purpose of this Guide This artefact proves that your company keeps track of all user accounts across systems . This is vital because it...

• Admin Account Screenshot Guide

  1. Purpose of this Guide This artefact proves that admin rights aren’t handed out like free samples . It shows that any administrator...

• Antivirus Agent Logs Guide

  1. Purpose of this Guide This artefact proves that all your company’s devices are actively protected by anti virus or endpoint detection and...

• Antivirus Screenshot Guide

  1. Purpose of this Guide This artefact shows that endpoints are actively protected by anti virus (also known as anti malware or Endpoint...

• Application Control List Guide

  1. Purpose of this Guide This artefact proves your company has rules about what software and file types are allowed (and which are banned)....

• Asset Inventory List Guide

  1. Purpose of this Guide This artefact shows your company has a complete and accurate inventory of IT assets — devices, systems, and...

• Asset Onboarding and Removal Process Guide

  1. Purpose of this Guide This artefact demonstrates that your company has a formal process for introducing and retiring IT assets ....

• Auto Software Updates Screenshot Guide

  1. Purpose of this Guide This artefact demonstrates that your company’s devices are set to automatically install security updates, patches,...

• Autorun Disabled Configuration Guide

  1. Purpose of this Guide This artefact shows that your company has disabled autorun and auto launch features on devices. Cyber compliance...

• Backup Automation Guide

  1. Purpose of this Guide This artefact demonstrates that your company has automated backup schedules in place , even for non critical...

• Business Critical Data Inventory List Guide

  1. Purpose of this Guide This artefact proves that your company has identified and catalogued its most valuable data — the crown jewels....

• Business Critical Data Protection Guide

  1. Purpose of this Guide This artefact proves that your organisation’s most valuable data — customer records, financial systems,...

• Cloud Backup Service Guide

  1. Purpose of this Guide This artefact shows that your company is using cloud provider backup services to protect data. Cyber Essentials...

• Cloud Logging Guide

  1. Purpose of this Guide This screenshot demonstrates that your organisation enables and retains logging of system activities on cloud...

• Physical Hard Disk Backup Guide

  1. Purpose of this Guide This artefact proves your organisation keeps a physical copy of cloud data on hard disks . Cyber Essentials...

• Crisis Communications Guide

  1. Purpose of this Guide This artefact demonstrates that your company has a plan for who communicates what, when, and to whom during a cyber...

• Cyber Incident Response Plan Guide

  1. Purpose of this Guide This artefact demonstrates that your company has a written, structured plan to handle cyber incidents . Cyber...

• Cybersecurity Awareness Training Guide

  1. Purpose of this Guide This artefact demonstrates that your company provides structured cybersecurity awareness training for staff. Cyber...

• Cybersecurity Guidelines Guide

  1. Purpose of this Guide This artefact shows your company has written cybersecurity guidelines for staff . Cyber compliance requires this...

• Data Backup Records Guide

  1. Purpose of this Guide This artefact proves that your company not only runs backups but also keeps proper records of them. Cyber...

• Disabling and Locking User Accounts Screenshot Guide

  1. Purpose of this Guide This artefact proves your company has the ability to promptly disable or lock user accounts when employees leave,...

• Endpoint OS Autoupdate Guide

  1. Purpose of this Guide This artefact demonstrates that your company’s laptops, desktops, and servers are configured to receive and install...

• Firewall Configuration Screenshot Guide

  1. Purpose of this Guide This artefact proves that your company has firewalls enabled and configured to block malicious traffic . For DNS...

• Hardware Asset Onboarding Authorization Form Guide

  1. Purpose of this Guide This artefact demonstrates that your company has a formal process for introducing and retiring IT assets . Cyber...

• Idle Session Timeout Screenshot Guide

  1. Purpose of this Guide This artefact demonstrates that your company enforces automatic log off after a set idle period . Cyber Essentials...

• IoT Backup Screenshot Guide

  1. Purpose of this Guide This artefact proves that your organisation’s IoT devices (for systems that are within scope) are backed up — even...

• Mail Server Internet Hygiene Portal Results Guide

  1. Purpose of this Guide This artefact proves your company’s mail servers are securely configured and resilient against phishing, spoofing,...

• Malware Scan Policy Screenshot Guide

  1. Purpose of this Guide This artefact proves that your company has anti malware solutions properly configured . Cyber Essentials requires...

• Multi-Factor Authentication Policy Enforcement Guide

  1. Purpose of this Guide This artefact proves your company has enforced MFA across user accounts , not just made it optional. Cyber...

• Mobile Backup Screenshot Guide

  1. Purpose of this Guide This artefact proves your company’s mobile devices are securely and automatically backed up . Cyber Essentials...

• Multi-Cloud Backup Guide

  1. Purpose of this Guide This artefact proves that your company isn’t putting all its eggs in one basket — you’re using multiple cloud...

• Network Diagram Guide

  1. Purpose of this Guide This artefact proves your company understands and documents how its network is structured and defended . Cyber...

• Non-Critical Backup Screenshot Guide

  1. Purpose of this Guide This artefact proves your company doesn’t only protect the “crown jewels” but also keeps less critical data backed...

• Non-Disclosure Agreement Guide

  1. Purpose of this Guide This artefact shows that your company uses NDAs to protect sensitive information when working with staff,...

• Offline Backup Screenshot Guide

  1. Purpose of this Guide This artefact proves that your company can recover data even if online systems are compromised . Cyber Essentials...

• Organisational Chart Guide

  1. Purpose of this Guide This artefact proves that your company has clear reporting lines and responsibilities . Cyber Essentials requires...

• Operating System Firewall Guide

  1. Purpose of this Guide This artefact proves your company has host firewalls enabled on all endpoints . Cyber Essentials requires this...

• Password Compromise Screenshot Guide

  1. Purpose of this Guide This artefact demonstrates your company’s ability to detect compromised passwords and immediately enforce a...

• Password Expiration Screenshot Guide

  1. Purpose of this Guide This artefact proves your company has password expiration policies configured. Cyber Essentials requires this...

• Physical Access Control Photo Guide

  1. Purpose of this Guide This artefact proves your company has physical barriers in place to stop unauthorised access to IT systems. Cyber...

• Physical Media Destruction Photo Guide

  1. Purpose of this Guide This artefact proves your company securely destroys paper based media so sensitive information doesn’t fall into...

• Risk Management Framework Guide

  1. Purpose of this Guide This artefact proves your company has a structured method to assess risks , especially when dealing with EOS (End...

• Risk Register Form Guide

  1. Purpose of this Guide This artefact proves your company records and manages identified risks in a structured way. Cyber Essentials...

• Secure Configuration (Cloud, Mobile, IOT) Guide

  1. Purpose of this Guide This artefact proves that your company has locked down the configuration of mobile devices, IoT equipment, and...

• Trusted Password Manager Guide

  1. Purpose of this Guide This artefact proves your company uses a trusted password manager to wrangle logins safely. Cyber Essentials...

• Unused Features Disabled Guide

  1. Purpose of this Guide This artefact proves your company trims away unnecessary system features that attackers could exploit. Cyber...

• Users Training Completion Screenshot Guide

  1. Purpose of this Guide This artefact shows your company doesn’t just talk about training but actually tracks who has completed it . Cyber...

• Web Server Internet Hygiene Portal Results Guide

  1. Purpose of this Guide This artefact proves your company’s web servers are configured securely . Cyber Essentials requires this because...

• System Logs Guide

  1. Purpose of this Guide This guide helps you submit a screenshot to demonstrate compliance with any clause that requires evidence of system...

• Mobile Firewall Guide

  1. Purpose of This Guide Mobile devices connect everywhere — office Wi Fi, home networks, public hotspots, airports, coffee shops, the void....

• IoT Firewall Guide

  1. Purpose of This Guide IoT devices (CCTV cameras, smart TVs, printers, door sensors, audio systems, etc.) connect directly to the internet...

• Staff List Guide

  1. Purpose of This Guide Your staff list is the cornerstone of your cybersecurity responsibilities. It shows who in your organisation has IT...

• Mobile Secure Configuration Screenshot Guide

  1. Purpose of This Guide Mobile devices (phones, tablets) often access company email, files, apps, and sensitive data. If they’re lost,...

• IoT Secure Configuration Screenshot Guide

  1. Purpose of This Guide IoT devices (CCTV cameras, door sensors, smart TVs, Wi Fi printers, IP speakers, etc.) often come with convenience...

• Logging Screenshot Guide

  1. Purpose of This Guide This evidence shows that your organisation has logging turned on for the key parts of your IT environment —...

• Incident Response Communication Guide

  1. Purpose of This Guide When a cyber incident strikes, your staff shouldn’t be running around like startled chickens. Everyone with IT...

• Data Flow Diagram Guide

  1. Purpose of This Guide A personal data flow diagram shows how personal data moves through your organisation — from the moment it is...

• Vendor Compliance Guide

  1. Purpose of This Guide This guide helps you collect evidence showing that your vendors and contractors are required to meet cybersecurity...

• EOS Stop Gap Guide

  1. Purpose of This Guide This guide helps you show that you’re not blindly running systems that are no longer supported without mitigation...

• Asset Inventory List ICT Vendor Guide

  1. Purpose of This Guide This guide helps you show that you maintain a clear, up to date inventory of hardware and software assets used by...

• Data At Rest / In Motion Encryption Guide

  1. Purpose of This Guide This guide helps you show that business critical and sensitive data is protected by encryption , both: At rest...

• Network Diagram Segmentation Guide

  1. Purpose of This Guide This guide helps you show that your network is intentionally designed and segmented , not one big flat battlefield....

• Security Testing Guide

  1. Purpose of This Guide This guide helps you show that your software and systems have been tested for security weaknesses — before going...

• WAF Screenshot Guide

  1. Purpose of This Guide This guide helps you show that your internet facing web applications are protected by a Web Application Firewall...

• Vulnerability Management Process Guide

  1. Purpose of This Guide This guide helps you show that your organisation systematically identifies, prioritises, and fixes security...

• DPO Registration Confirmation Guide

  1. Purpose of This Guide This artefact proves that your organisation has appointed and registered a Data Protection Officer (DPO) with the...

• Data Protection Notice Guide

  1. Purpose of This Guide This artefact proves that your organisation has published a Data Protection Notice that is publicly accessible and...

• PDPC e-Learning Completion Guide

  1. Purpose of This Guide This artefact proves that all employees have completed the official PDPC e Learning course , covering PDPA...

• PDPA e-Assessment Results Guide

  1. Purpose of This Guide This artefact proves that employees have passed the official PDPA e assessment with a minimum score of 80% , as...

• Auto-Email Forwarding Disabled Screenshot Guide

  1. Purpose of This Guide This artefact proves that automatic email forwarding to external addresses is disabled at the organisation level ....

• Phishing Simulation After-Action Report Guide

  1. Purpose of This Guide This artefact proves that your organisation actively trains staff to recognise and respond to phishing , instead of...

• Tabletop Exercise After-Action Report Guide

  1. Purpose of This Guide This artefact proves that your organisation actively tests its cyber and data breach response plan , not just files...