Cyber Essentials for Mac: How to Get Certified and Stay Compliant, Continuously
Cyber Essentials for Mac: How to Get Certified and Stay Compliant, Always
It’s Tuesday. Your Cyber Essentials renewal is due Friday, and someone on your team is walking the office with a laptop, checking Macs one at a time. Is the firewall on? Is FileVault turned on? Who still has admin rights? Did that Safari update actually land, or is it sitting in a notification nobody clicked?
Every answer goes into a spreadsheet. By the time the spreadsheet is finished, half of it is already out of date.
If you manage a mixed estate, you know the Macs are often the awkward part. The Windows side has had compliance tooling for years. The Macs get a checklist, a screenshot folder and a lot of hoping.
This post is for the Head of IT, IT manager or IT director who has just been told “we need Cyber Essentials” and wants a clear path through it. You don’t need to be a security expert. You need to know what the scheme asks for, what changed in April 2026, and how to get every Mac to a provable pass without spending a week on it.
What is Cyber Essentials?
Cyber Essentials is the UK government-backed certification that shows an organisation has the basic technical controls in place to stop the most common cyber attacks. The National Cyber Security Centre (NCSC) owns the scheme. IASME runs it day to day and licenses the certification bodies that actually award the certificate.
There are two levels:
- Cyber Essentials is a self-assessment questionnaire. You answer it, a board-level contact signs it off, and a certification body verifies your answers.
- Cyber Essentials Plus covers the same controls, but an assessor also runs a hands-on technical audit against a sample of your devices.
Certification lasts 12 months, so this is an annual job, not a one-off.
Who needs Cyber Essentials?
More organisations than you might think. Enterprise customers and firms in regulated sectors increasingly ask for it in supplier due diligence. Cyber insurers ask about the same controls at quote and at renewal. Boards want assurance that the basics are covered. And it remains a standard condition of many UK public-sector contracts.
For an in-house IT team, that usually means Cyber Essentials arrives as a request from sales, finance or the board, often with a deadline attached.
The 5 Cyber Essentials controls, through a Mac lens
The scheme comes down to five technical controls. Macs are in scope like any other endpoint, and the evidence has to be accurate at the point of assessment, not just on the day someone last checked.
| Control | What it means on macOS | What an assessor looks for |
| Firewalls | The built-in macOS application firewall is on, on every device, not just at the network boundary | Firewall enabled and enforced; no device relying on the office router alone |
| Secure configuration | Defaults hardened, unused software removed, screen lock on a short timer, FileVault on, auto-run and guest access sorted | Consistent settings across the fleet, enforced by policy rather than set by hand |
| Security update management | Supported macOS versions only; high and critical OS, app and firmware patches applied within 14 days of release | Timestamped patch status per device, including third-party apps like browsers |
| User access control | Everyday accounts are standard users, not admins; strong authentication and MFA on accounts and cloud services | No daily-driver admin accounts; MFA switched on everywhere it’s offered |
| Malware protection | Anti-malware or application allow-listing on every in-scope Mac | Evidence that protection is installed, running and current on each device |
What changed in 2026: the Danzell update
On 27 April 2026, requirements v3.3 (“Danzell”) replaced v3.2 (“Willow”) and now applies to any assessment started from that date. The five controls haven’t changed. The marking has, and there’s a lot less room for error.
Under Willow you could carry up to two major non-compliances and still pass. Danzell turns the most critical ones into automatic fails:
- Miss the 14-day patch window and you fail. High and critical updates to the OS, third-party apps and firmware must be applied within 14 days of release. One Mac with one missed patch fails the whole assessment.
- MFA on every cloud service that offers it, even where MFA is a paid add-on. For Mac shops, that means Managed Apple Accounts for business use, not personal Apple IDs.
- Cloud services can’t be excluded from scope, and that includes AI tools such as Copilot, ChatGPT Enterprise and Gemini.
- Evidence, not just answers. Assessors expect timestamped patch reports and proof that policies are enforced, not a tick in a box.
The practical consequence: Apple releasing an update is not the same as every Mac installing it. If you can’t see patch status across the fleet today, you can’t know whether you’d pass today. (URM Consulting, Digital Origin)
Proof, not promises: why real-time compliance affects your insurance
A Cyber Essentials certificate is a snapshot. It says you were compliant on one day of the year. Insurers and customers increasingly want to know whether you’re compliant today.
At quote and at renewal, insurers are asking for evidence of the same controls Cyber Essentials covers: MFA, patching, encryption, admin rights. If you can’t show it, expect higher premiums, exclusions, or a harder conversation if you ever need to claim.
That’s the difference between “we think we’re compliant” and evidence you can hand over. A live view of device posture, plus a report you can export on demand, turns the first into the second. It also means the renewal is a formality rather than a scramble.
Why Mac compliance is hard today
Most Mac estates are still checked by hand. Someone opens System Settings on each device, notes what they find, and the spreadsheet is stale the day after. Multiply that by every device and every renewal, and your team can lose days to it.
Generic compliance tooling doesn’t help as much as you’d hope. Most of it is built around US frameworks, and the UK details get lost. IASME, for example, accepts biometrics like Touch ID as part of strong authentication; a benchmark written for a different scheme may flag it as a fail and send you chasing a problem you don’t have.
And Macs rarely get the same attention as Windows in a mixed estate. They end up as the gap in the evidence, the devices the assessor asks about twice.
How Addigy helps: a native Cyber Essentials benchmark for macOS
Addigy now includes a native Cyber Essentials benchmark for macOS, out of the box. Something you won’t find in other Apple MDMs. It’s mapped to the current scheme requirements. It runs in the same place and the same way as Addigy’s existing CIS benchmarks, so if you’ve used those, there’s nothing new to learn.
Assess in one click. Run the benchmark across a single Mac, a site, a department or your whole estate and get a pass or fail against each device-level CE control. No walking the office. No spreadsheet.
See it per device and across the fleet. The compliance dashboard shows where every Mac stands, control by control, so you know which three devices are failing on firewall before the assessor does.
Export the evidence. Reports are built for the people who ask for them: assessors, customers, insurers and your board. Timestamped patch status is exactly what Danzell expects you to produce.
Fix the gaps, with approval. Failed settings can be remediated automatically, and every fix comes with a plain-language description of what will change. An admin approves it before anything happens on the device.
Stay compliant, not just certified. The benchmark keeps monitoring after the assessment, so drift gets caught in days rather than at next year’s renewal.
The benchmark is included in Addigy’s Intelligence Suite and as part of the Compliance Engine add-on.
What it does and doesn’t do
Addigy doesn’t complete the certification for you. It handles the most important part, getting every Mac to a provable pass and producing the evidence to show it, so the rest of the process is quick and efficient.
It doesn’t submit anything to a certification body or replace the hands-on testing in Cyber Essentials Plus, and it covers macOS today; iOS and iPadOS are not yet included.
Where do I start? Getting to certified without being an expert
If you’ve never been through Cyber Essentials, here’s the path. It’s written for IT leaders, not security specialists.
- Scope it. List your devices, users and cloud services, including AI tools. Decide whether you’re certifying the whole organisation or a defined part of it.
- Read the questions early. Download the current self-assessment question set from IASME’s preview page and work through the free Cyber Essentials Readiness Tool. Nothing in the questionnaire should be a surprise.
- Get a baseline. Run the Cyber Essentials benchmark across your Macs to see where you stand today, control by control.
- Fix the gaps. Remediate failed settings, switch on MFA everywhere it’s offered, remove everyday admin rights, and get patching on a 14-day clock.
- Gather evidence. Export reports and take screenshots before you open the questionnaire, not after.
- Submit. Choose an IASME-licensed certification body and complete the assessment.
- Stay compliant. Keep monitoring so renewal, and your insurer, never catch you out.
You don’t have to do this alone. If you work with an IT partner, they can help with steps 1 to 5, and Addigy does the heavy lifting on the Macs.
What it looks like in practice: Air IT
Air IT, a UK IT provider, keeps its customers’ Macs inside the 14-day patch window with Addigy. Here’s how they describe the requirement, in their own words:
“If a piece of software or an operating system has a security vulnerability with a CVSS 3.1 rating of 7.0 or above, and the vendor has released the patch, we have to get it applied within fourteen days. It’s a big undertaking to make sure all that software and all those operating systems are up to date.
“With Addigy we can remediate against that. Prebuilt packages, fantastic. You set a deadline of fourteen days and it will go ahead and patch that software. If there’s something that’s not in the catalogue, we can patch it. And the operating system we can patch with declarative device management and get that enforced within fourteen days.
“That has always been a major hurdle. If you don’t have the correct tools in place, it’s really, really hard. Addigy has made keeping compliance for our customers really simple.”
Get your Macs to a provable pass
If your next Cyber Essentials renewal is coming up, don’t start with a spreadsheet. Book a demo and see the Cyber Essentials benchmark run against a real Mac fleet.
Already on Addigy? It’s waiting for you under Benchmarks.Script Assist and Smart Filters are available to Addigy customers today. Try the Addigy Intelligence Suite.
