Short answer
Linux systems are in scope when they fall within the agreed assessment boundary. Meet the applicable firewall, configuration, access and update controls. Under v3.3, application allow listing is the malware-protection option available across all platforms; do not assume installing ClamAV alone establishes the required Linux control.
Why this matters
Technical-control questions decide whether the self-assessment can be approved. Cyber Essentials is not a paper-only exercise: the applicant must be able to show that secure configuration, patching, access control, malware protection, and firewalls are implemented in the actual environment.
The strongest submissions use evidence from device management, endpoint security, vulnerability scanning, identity controls, and asset registers. If a control is implemented manually, the organisation should still be able to explain ownership, frequency, and how exceptions are handled.
What to check next
- Apply every qualifying high-risk, CVSS v3 7+ or unspecified-severity fix within 14 days of release.
- Remove unsupported software or agree the permitted isolated subset with the assessor.
- Keep endpoint protection, firewall rules, and admin accounts documented.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.