Cyber Essentials is the UK government's baseline cybersecurity certification, required for government contracts and increasingly expected by enterprise customers. Password controls are one of the five technical control areas assessed. Understanding exactly what is required — and what common approaches fail the assessment — prevents surprises at certification time.
The Five Technical Controls — Password Requirement
Cyber Essentials assesses five control categories: firewalls, secure configuration, access control, malware protection, and patch management. The password requirements fall under Access Control. Specifically, assessors check:
- No default credentials: All default passwords on all devices, services, and accounts must have been changed before deployment
- No easily guessable passwords: Technical controls must prevent or detect weak password choices — typically via a business password manager that enforces generated passwords
- Account lockout or MFA: After a maximum of 10 failed login attempts, either the account must lock out, or MFA must be enabled — or both
- Privileged account security: Administrator accounts must use strong, unique credentials — ideally enforced by a PAM (Privileged Access Management) solution or at minimum a password manager
- Off-boarding process: Accounts and credentials for departing staff must be disabled or changed promptly — assessors will ask about your process
Common Compliance Failures
| Common approach | Compliant? | Issue |
|---|---|---|
| Shared team password in a spreadsheet | ✗ No | No access control, no audit log, no off-boarding mechanism |
| Router/firewall with default password | ✗ No | Default credentials explicitly prohibited |
| Individual email accounts, no MFA | ⚠ Risk | Account lockout required; cloud email without MFA is high-risk |
| Business password manager, MFA on email | ✓ Yes | Meets access control requirements |
| Passwords in browser autofill only | ⚠ Risk | No access control, no audit trail — borderline |
The Minimum Compliant Setup
For most SMEs, the minimum compliant password posture is: a business password manager (Bitwarden Business, 1Password Teams) where all staff have individual vaults; MFA enabled on all cloud services (Microsoft 365, Google Workspace, CRM); all devices have changed default admin passwords; and a written off-boarding checklist for leavers. The Work Password Policy Builder generates a compliant policy paragraph you can add to your staff handbook.