Can Linux desktops pass Cyber Essentials?

Yes, Linux desktops can pass Cyber Essentials. The scheme doesn't require any particular operating system: a Linux desktop is assessed against the same five technical controls as a Windows PC or a Mac, and a managed Ubuntu LTS desk can meet all of them. What counts is how each desk is set up and kept up to date, and whether you can show it.

What Cyber Essentials asks for

The NCSC sets the requirements in Cyber Essentials: Requirements for IT Infrastructure v3.3, which has applied since 27 April 2026. IASME is the NCSC's Cyber Essentials delivery partner, and certification bodies licensed by IASME carry out assessments. The five controls are firewalls, secure configuration, security update management, user access control and malware protection.

Scope matters as much as the controls:

• end-user devices must be in scope, so every Linux desk and laptop used for company business is included, home-working ones too;
• servers are in scope, whether they sit in your office or are rented from a hosting company;
• cloud services that hold your data can't be excluded, so anything you keep, such as Exchange Online or Teams, stays in scope.

Firewalls

Every device in scope must be protected by a correctly configured firewall. Devices used on networks you don't control, such as home broadband or public wifi, need a software firewall on the device itself, and the requirements advise using the one that comes with the operating system.

Ubuntu's default firewall tool, ufw, starts out disabled (Ubuntu documentation: firewalls). On a managed desk it is switched on and blocks unauthenticated inbound connections by default. Any rule that lets traffic in is approved by an authorised person, written down with its business need, and removed when it is no longer needed.

Secure configuration

Each desk has to be set up so that it only runs what is needed. The requirements ask you to:

• remove or disable accounts and software that aren't needed;
• change any default or guessable passwords;
• turn off any auto-run feature that lets files run without the user's say-so;
• make users authenticate before they reach company data, with a password, PIN or biometric to unlock the device;
• protect that unlock against guessing, by allowing no more than 10 guesses in 5 minutes or locking after no more than 10 failed attempts.

On a Linux desk the unlock password is normally the account password, so the full password rules under user access control apply to it, not just the 6-character minimum for unlock-only PINs. A desk built for one role starts with little installed, so there is less to remove and less to check.

Security update management

This is the control with dates attached. All software on an in-scope device must be licensed and supported, and the vendor must publish the date when it will stop providing security fixes. Software has to be removed when support ends, automatic updates must be on where possible, and an update must be installed within 14 days of release when:

• it fixes vulnerabilities the vendor describes as critical or high risk;
• it fixes a vulnerability with a CVSS v3 base score of 7 or above;
• the vendor gives no details of how serious the fixed vulnerabilities are.

If one update fixes several issues and any of them is critical or high risk, the whole update falls under the 14-day rule.

For Ubuntu, Canonical publishes the end dates (Ubuntu release cycle). Each LTS release gets five years of standard security maintenance for the packages in its Main repository: Ubuntu 24.04 LTS until May 2029, and Ubuntu 26.04 LTS until May 2031. Three details matter for Cyber Essentials:

• Packages from Ubuntu's Universe repository aren't covered by standard maintenance. They get security coverage through Ubuntu Pro, Canonical's subscription, or they should stay off the desk.
• Interim releases, the ones that aren't LTS, get only 9 months of updates.
• Apps from other vendors, such as a web browser, follow that vendor's support dates and need the same checks.

Ubuntu can install security updates automatically, without anyone at the desk (Ubuntu documentation: automatic updates). On a managed desk this is switched on and every desk reports back, so one that missed an update is found and fixed inside the 14 days.

User access control

You must be in control of every account that reaches company data and services, including accounts your IT provider uses. The requirements ask for:

• a process to create and approve accounts;
• unique credentials for every user before they reach apps or devices;
• accounts removed or disabled when they are no longer needed, for example when someone leaves;
• MFA wherever it is available, and always for cloud services;
• separate accounts for admin work, not used for email or web browsing;
• admin rights removed when someone no longer needs them.

Where passwords are used, their quality should be managed in one of three ways: MFA, a minimum of 12 characters, or a minimum of 8 characters with common passwords blocked.

On a Linux desk, staff log in with standard accounts that have no administrator (sudo) rights. Admin work is done from separate accounts that aren't used for anything else. With one sign-in service across your apps, MFA and leavers are both handled in one place.

Malware protection

Every device in scope must have an active malware protection mechanism. Version 3.3 of the requirements lists anti-malware software as an option for devices running Windows or macOS, and application allow listing as an option for all devices. For a Linux desk, that points to allow listing.

Allow listing means only approved applications, restricted by code signing, are allowed to run. You must approve each application before it is deployed, keep a current list of approved applications, and make sure users can't install anything unsigned or with an invalid signature. On a managed Ubuntu desk, that looks like this:

• software comes only from Ubuntu's signed archive and other approved, signed sources;
• each role has a written list of the apps it is allowed;
• staff can't install software, because they have no admin rights;
• programs a user downloads, or saves in their own folders, aren't allowed to run.

The last point takes deliberate set-up. A standard Ubuntu install lets a user run a program saved in their home folder, so a desk that relies on allow listing has to close that off. For Cyber Essentials Plus, the assessor checks that an unsigned program, or one signed with a certificate that isn't trusted, won't run on the devices they sample (NCSC: Cyber Essentials resources).

What isn't required

Some good practice sits outside Cyber Essentials:

• Disk encryption isn't a Cyber Essentials requirement. We set it up on every desk anyway, because it protects the data on a lost or stolen laptop.
• Backups aren't a technical requirement either, though the NCSC highly recommends them in the same document.

What the evidence looks like

For Cyber Essentials, you answer the IASME question set, a board member or equivalent signs off the answers, and an assessor marks them. Answers about Linux desks are easiest to support when you can show:

• a list of every desk and laptop, with its Ubuntu release and when that release's maintenance ends;
• update reports showing when security updates were installed on each device;
• the firewall status and inbound rules for each build, with the business need for each rule;
• the approved app list for each role;
• a list of accounts, showing which are admin accounts and who holds them;
• the MFA settings on your sign-in service and on any cloud services.

For Cyber Essentials Plus, an assessor also tests the setup. The NCSC test specification includes a remote vulnerability scan, an authenticated scan of sampled devices for missing critical or high-risk fixes older than 14 days, checks on malware protection, a check that cloud services ask for MFA, and a check that a standard user can't run an admin task without a separate login. Where devices share a standard configuration, it notes that a small number of representative samples can cover them, which is where building every desk from the same written configuration helps.

If you're planning a move to Linux desks and need to keep your Cyber Essentials, book a planning call. We'll go through your current scope and how each control would be met on the new setup. The guide to Linux desktops for business covers the desks themselves.

Common questions