Installing security software is only part of protecting your business. The settings on your computers, servers and network equipment matter too.

Secure configuration and malware protection are two of the five Cyber Essentials controls. Together, they help reduce avoidable weaknesses and prevent malicious software from causing harm.

What does secure configuration mean?

Devices and applications do not always arrive with settings suited to your business. They may include accounts, software or services you do not need.

Secure configuration means reviewing those settings and keeping only what is necessary for the device’s role.

Practical checks include:

• Removing or disabling unnecessary accounts.
• Changing default or easily guessed passwords.
• Removing software and services that are not needed.
• Disabling features that run files automatically without user authorisation.
• Requiring authentication before people can access business information.
• Configuring appropriate device locking and unlocking controls.

For example, an unused account or an unnecessary remote access service can create an avoidable route into your systems.

Review settings as your business changes, rather than treating configuration as a one-off installation task.

How should you protect devices against malware?

Malware is malicious software, including ransomware, designed to damage systems, steal information or disrupt operations.

Cyber Essentials requires active malware protection on every device in scope. Accepted approaches include appropriately configured anti-malware software on Windows and macOS devices, or application allow listing, which restricts devices to approved, signed applications.

Where anti-malware software is used, it must stay updated and prevent malicious software, code and website connections.

Ask your IT team how they check that protection is working across office equipment and remote workers’ devices.

What extra protection can your network provide?

Network security can add another layer of defence.

Cisco Umbrella can help block connections to malicious destinations, while a suitably configured next-generation firewall can provide additional threat detection and filtering.

These tools can work alongside device protection. They should not be treated as interchangeable alternatives, and their effectiveness depends on the features enabled and how they are managed.

Ask your provider what each product protects, where its coverage ends and who responds when it identifies a threat.

Should you back up device configurations?

Configuration backups are useful additional good practice, although backups are not a technical requirement of Cyber Essentials.

A configuration backup records settings, such as those on a router or firewall. It can help your IT team restore an agreed setup after equipment failure or an unsuccessful change.

We recommend agreeing a backup schedule that reflects how often settings change, including taking backups after approved changes.

Keep copies protected from unauthorised access and alteration, use encryption during transfer and storage where appropriate, and check that your team can restore them. A private connection alone should not be assumed to encrypt a backup.

Remember that a configuration backup does not replace backups of your business files and other data.

Start by checking what is already in place

Ask your IT team or provider:

• Which devices and settings are reviewed?
• How is malware protection checked?
• Do remote workers receive appropriate protection?
• Who manages security alerts and configuration changes?
• Are configuration backups available and usable?

These questions help identify gaps and clarify who will address them.

Speak to Beaming about reviewing your device and network security as part of your Cyber Essentials preparation.