TenuVaultDesktopPractical guide
Cyber Essentials Intune checks
Cyber Essentials Intune checks help you review device configuration against the scheme's technical requirements. TenuVault maps selected settings to Cyber Essentials references, leaving device verification and certification decisions to the appropriate assessment process.
Which devices belong in Cyber Essentials Intune checks?
Start with the NCSC Requirements for IT infrastructure document applicable to your assessment. The five control themes are firewalls, secure configuration, security update management, user access control and malware protection. Use the current owner publication to determine the requirements rather than translating a policy name into a pass.
TenuVault documents a native Cyber Essentials v3.3 comparison. Record that mapping version and compare it with the requirements applicable to your application. Include all relevant platforms in the review, then document systems outside Intune separately. A policy mapping cannot establish that the whole certification boundary is covered.
Where are the five Cyber Essentials checks in Intune?
Use the five Cyber Essentials themes to organize your Microsoft policy review. For firewalls, open Endpoint security firewall policies and inspect the profiles assigned to the Windows or macOS devices in scope. For malware protection on Windows, examine the antivirus policies and the actual reported device condition. These are different workloads, so a successful firewall profile does not answer the malware protection question.
For secure configuration, look at the Settings Catalog profiles that define the approved device settings. For user access control on Windows, account protection policies can manage local user group membership; review who receives the administrator settings. Broader account and cloud access questions still need the identity administrator rather than an inference from a laptop profile.
For security update management, review Windows update rings and their deadlines, deferrals and restart settings, then investigate devices missing the expected updates. Application updates and systems managed outside Intune need separate attention. These policy locations are practical collection points for the scheme themes, not a claim that configuring one profile satisfies every requirement in a theme.
How do I compare Cyber Essentials settings in Intune?
1. From Frameworks, open Cyber Essentials for the correct tenant. Read the documented v3.3 mapping scope and compare it with the scheme requirements applicable to your application.
2. Under Platforms in scope, select the managed operating systems within the certification boundary. Start Compare settings without changing the existing firewall, antivirus or configuration policies.
3. Follow each relevant finding into Setting-by-setting evidence and inspect the assigned policy values. Treat Unknown as information still needed, and investigate Missing or Different before proposing a correction.
4. Export the Cyber Essentials findings together with their coverage limitations. Use those results to direct the device and account checks your application still needs.
Community supports this Cyber Essentials comparison and the associated PDF, CSV and JSON files, independently of the scheme's certification process.
How should I follow up on each control theme?
For firewall and malware protection findings, inspect expected values, assigned policies and device reporting. For update management, retain evidence of actual update status as well as the configured policy. For user access control, include the identity and administrative access review needed for your scope. Secure configuration also needs verification on the affected systems. These are practical collection prompts, not alternative requirements or a complete scheme checklist.
Work through one theme at a time with the administrator responsible for it. A firewall finding may need a targeting correction; an update finding may instead reveal a device that has stopped reporting. Record the actual cause and the follow-up check, rather than describing every issue as a missing policy.
After resolving a difference, check the affected population again and retain the new observation with the original finding. Be explicit about devices outside management and controls checked elsewhere. A clean Intune comparison cannot close a question about a server, network device or cloud account that it did not examine.
Can I try a five-theme review on one device group?
Download TenuVault and run Cyber Essentials Intune checks for a defined managed-device group. Use the findings to walk through all five themes with the people who maintain those systems.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is this a Cyber Essentials certification check?+
It is a configuration comparison with mapped references. It does not certify the organization or replace the scheme's assessment.
Is an update policy enough evidence for update management?+
A policy describes intended configuration. Check actual update status and the applicable scheme requirements before drawing a conclusion.
What about devices outside Intune?+
Document them in your assessment boundary and collect evidence through the appropriate management process. They are not verified by an Intune comparison.