Section 5: Secure configuration
NCSC requires you to regularly remove or disable unnecessary software, including applications, system utilities and network services (Requirements v3.3, page 15). To see what is installed on:
- Windows - right-click Start then Apps and Features
- Mac - open Finder then Applications; on Linux, use your software package manager
Remove or switch off software and services you do not use every day on:
- school computers
- laptops
- thin clients
- servers
- tablets
- phones
- cloud services
An accepted way to do this is with a standard build, where you decide in advance what is installed on every device. Also, check your cloud services and turn off features you do not need.
Every device and cloud service should only hold accounts that are needed and regularly used. Remove or disable guest accounts, leaver accounts, and admin accounts that will not be used (NCSC Requirements v3.3, page 15).
To see the accounts on:
- Windows - right-click Start, then Computer Management, then Users
- Mac - open System Settings then Users and Groups
- Linux - run 'cat /etc/passwd'
A default password is one set by the manufacturer or supplier, or a guessable one such as 'password', 'admin' or '12345'. Change it on every user and administrator account on school:
- computers
- laptops
- thin clients
- servers
- tablets
- phones
New passwords must also meet the Cyber Essentials password rules of using MFA, or at least:
- 12 characters
- 8 characters with automatic blocking of common passwords
NCSC says users must be authenticated before they can reach school data or services (Requirements v3.3, page 15). Answer Yes if your school or Trust runs software that staff, parents or others can reach over the internet to get information that should not be public. Examples are a:
- VPN server
- mail server
- remote desktop gateway
- web application you host yourselves
Cloud services you subscribe to from other companies, such as Microsoft 365 or Google Workspace, are listed in 2.9 and covered by 7.14 to 7.17.
If you answer Yes, you must also answer 5.5 to 5.7.
If you answered Yes to 5.4:
- choose every option that applies to how people log in to your external services
- do not set a maximum password length
"Passwordless" means identity is proved by something other than a password, such as a security key, passkey, fingerprint or one-time code.
If you answered No to 5.4 , write 5.4 was No - we run no external services.
NCSC explains the password rules on pages 20 to 22 of Requirements v3.3.
If you answered Yes to 5.4, describe what you do if you think a password on an external service has been compromised. For example, after a virus or a warning from the supplier:
- who is told
- how quickly passwords are changed
- who checks it has been done
NCSC requires an established process to change passwords promptly if you know or suspect a compromise (Requirements v3.3, page 22).
If you answered No to 5.4, write 5.4 was No - we run no external services.
If you answered Yes to 5.4 and do not use MFA on that service, your external service must slow down or stop login attempts after wrong passwords. "Throttling" means the wait between attempts grows with each failed attempt, with no more than 10 guesses in 5 minutes. Alternatively, lock accounts after no more than 10 failed attempts.
If you use MFA, say so here.
If you answered No to 5.4, write 5.4 was No - we run no external services.
NCSC explains these options on page 21 of Requirements v3.3.
Auto-run starts software from a USB stick or a download without asking the user.
Answer Yes if it is switched off, or if users are asked to choose what happens each time they insert a memory stick or download a file. NCSC requires auto-run features that allow file execution without user authorisation to be disabled (Requirements v3.3, page 15).
NCSC requires appropriate device locking for users who are physically present (Requirements v3.3, pages 15 to 16).
Every device that someone must be physically present to use, such as a laptop or phone, must require a password, PIN or biometric (fingerprint or face) to unlock it. This includes school-owned devices used by pupils and staff, and staff personal devices used for school email.
You do not need a mobile device management (MDM) tool to do this.
If you answered Yes to 5.9, describe how people unlock each type of school device.
A biometric or a PIN or password of at least 6 characters is accepted only if it is used to unlock the device and does not give access to school data without a further login. If the same password is also used to sign in to school systems, the full password rules apply (MFA, or at least 12 characters, or at least 8 characters with automatic blocking of common passwords).
You must also protect against guessing. Allow no more than 10 guesses in 5 minutes, or lock the device after no more than 10 failed attempts. If the device does not let you change this, use the manufacturer's default (NCSC Requirements v3.3, page 16).
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.