# Cyber Essentials Intune checks | TenuVault Cyber Essentials Intune checks: review mapped device settings, record scope and identify the supporting evidence needed beyond a configuration comparison. Canonical: https://www.tenuvault.com/guides/cyber-essentials-intune-checks Practical guide # Cyber Essentials Intune checks Cyber Essentials Intune checks help you review device configuration against the scheme's technical requirements. TenuVault maps selected settings to Cyber Essentials references, leaving device verification and certification decisions to the appropriate assessment process. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Which devices belong in Cyber Essentials Intune checks? Start with the NCSC Requirements for IT infrastructure document applicable to your assessment. The five control themes are firewalls, secure configuration, security update management, user access control and malware protection. Use the current owner publication to determine the requirements rather than translating a policy name into a pass. TenuVault documents a native Cyber Essentials v3.3 comparison. Record that mapping version and compare it with the requirements applicable to your application. Include all relevant platforms in the review, then document systems outside Intune separately. A policy mapping cannot establish that the whole certification boundary is covered. - [NCSC Cyber Essentials resources](https://www.ncsc.gov.uk/cyberessentials/resources) - [Requirements for IT infrastructure v3.3](https://www.ncsc.gov.uk/sites/default/files/documents/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) ## Where are the five Cyber Essentials checks in Intune? Use the five Cyber Essentials themes to organize your Microsoft policy review. For firewalls, open Endpoint security firewall policies and inspect the profiles assigned to the Windows or macOS devices in scope. For malware protection on Windows, examine the antivirus policies and the actual reported device condition. These are different workloads, so a successful firewall profile does not answer the malware protection question. For secure configuration, look at the Settings Catalog profiles that define the approved device settings. For user access control on Windows, account protection policies can manage local user group membership; review who receives the administrator settings. Broader account and cloud access questions still need the identity administrator rather than an inference from a laptop profile. For security update management, review Windows update rings and their deadlines, deferrals and restart settings, then investigate devices missing the expected updates. Application updates and systems managed outside Intune need separate attention. These policy locations are practical collection points for the scheme themes, not a claim that configuring one profile satisfies every requirement in a theme. - [Firewall, antivirus and other security workloads](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-policy) - [Local user groups through account protection](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-account-protection-policy) - [Update rings and Windows installation behavior](https://learn.microsoft.com/en-us/intune/intune-service/protect/windows-10-update-rings) ## How do I compare Cyber Essentials settings in Intune? 1\. From Frameworks, open Cyber Essentials for the correct tenant. Read the documented v3.3 mapping scope and compare it with the scheme requirements applicable to your application. 2\. Under Platforms in scope, select the managed operating systems within the certification boundary. Start Compare settings without changing the existing firewall, antivirus or configuration policies. 3\. Follow each relevant finding into Setting-by-setting evidence and inspect the assigned policy values. Treat Unknown as information still needed, and investigate Missing or Different before proposing a correction. 4\. Export the Cyber Essentials findings together with their coverage limitations. Use those results to direct the device and account checks your application still needs. Community supports this Cyber Essentials comparison and the associated PDF, CSV and JSON files, independently of the scheme's certification process. - [Framework coverage workflow and limitations](https://docs.tenuvault.com/baselines/frameworks/) ## How should I follow up on each control theme? For firewall and malware protection findings, inspect expected values, assigned policies and device reporting. For update management, retain evidence of actual update status as well as the configured policy. For user access control, include the identity and administrative access review needed for your scope. Secure configuration also needs verification on the affected systems. These are practical collection prompts, not alternative requirements or a complete scheme checklist. Work through one theme at a time with the administrator responsible for it. A firewall finding may need a targeting correction; an update finding may instead reveal a device that has stopped reporting. Record the actual cause and the follow-up check, rather than describing every issue as a missing policy. After resolving a difference, check the affected population again and retain the new observation with the original finding. Be explicit about devices outside management and controls checked elsewhere. A clean Intune comparison cannot close a question about a server, network device or cloud account that it did not examine. ## Can I try a five-theme review on one device group? Download TenuVault and run Cyber Essentials Intune checks for a defined managed-device group. Use the findings to walk through all five themes with the people who maintain those systems. - [Compare Intune with security frameworks](https://www.tenuvault.com/guides/compare-intune-with-security-frameworks) - [Document Intune configuration for an audit](https://www.tenuvault.com/guides/document-intune-configuration-for-audit) - [Back up the configuration behind your evidence](https://www.tenuvault.com/intune-backup) - [Download TenuVault](https://www.tenuvault.com/download) ## Read the technical guides - [Framework coverage](https://docs.tenuvault.com/baselines/frameworks/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Is this a Cyber Essentials certification check? A: It is a configuration comparison with mapped references. It does not certify the organization or replace the scheme's assessment. ### Q: Is an update policy enough evidence for update management? A: A policy describes intended configuration. Check actual update status and the applicable scheme requirements before drawing a conclusion. ### Q: What about devices outside Intune? A: Document them in your assessment boundary and collect evidence through the appropriate management process. They are not verified by an Intune comparison. ## Related guides - [validate your Intune baseline](https://www.tenuvault.com/openintunebaseline) - [Def Stan 05-138 Intune mapping](https://www.tenuvault.com/guides/def-stan-05-138-intune-mapping) - [How to document Intune configuration for an audit](https://www.tenuvault.com/guides/document-intune-configuration-for-audit) - [Essential Eight Intune checks](https://www.tenuvault.com/guides/essential-eight-intune-checks) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)