Cyber Essentials: Your UK security guide

Cyber Essentials is a UK government-backed cyber security certification scheme designed to help organisations protect themselves against the cyber threats that are increasingly at play today. This certification guides businesses to establish a robust cybersecurity posture. Aside from gaining enhanced protection from cyber threats and aligning with compliance frameworks such as GDPR, the certification can inspire confidence in customers by acting as evidence that you take cyber security seriously, and is highly advantageous for businesses that bid for government contracts.

In this part of our practical guide to becoming secure to the best UK standard, we will walk you through the structure of Cyber Essentials, the certification process, and the numerous benefits it can offer for your business. In later pieces, we will walk you through how to implement the five key controls that will enable your business to get certified.

Why Cyber Essentials Is Important

Cyber Essentials was launched back in 2014 but its relevance has only increased over time. In recent years cyber threats have been growing in number and sophistication across the world, with mounting consequences for businesses that are successfully breached by cyber criminals.

60% of businesses that suffer a cyber-attack close their doors within 6-months, while the average cost of a data breach in the UK is £8460. In this context, getting certified by implementing the five key controls of the Cyber Essentials scheme can be a game changer for your business.

The Five Key Controls of Cyber Essentials in a Nutshell

The five key controls are the core focus of the Cyber Essentials scheme. They form the pillars of assessment for certification. The five controls and what they entail are:

Secure Configuration: Making sure all devices and software are set up in a safe way and updated regularly to protect against weaknesses that can be exploited by cyber threats.

Boundary Firewalls and Internet Gateways: Creating barriers to control who can access your network from the outside and who can leave from your network, keeping out unauthorised people.

Access Control: Setting up controls to limit what each person can access on your computers and data, based on their job roles.

Patch Management: Keeping computer programs up-to-date with the latest security fixes to avoid getting hacked through known weak points.

Malware Protection: Installing professional security software to defend against viruses, ransomware, and other harmful programs.

We’ll delve more into how to practically apply these protections later in this series.

It’s important to remember that cyber security is never a single-fix action, and that there are no off-the-shelf products that can be used to solve all your online security challenges. Instead, cyber security is an evolutionary process that involves risk mitigation strategies across three key areas: people, processes and technical defences.

The Three Key Areas of Cyber Security: People, Process, & Technical Defences

A good way to consider and implement the 5 key controls of Cyber Essentials is by dividing them into three categories. These are people, process and technical defences. Each of these cybersecurity areas can be used to strengthen the five key controls.

People

Your people can be your greatest cyber security asset! Employees should be involved in creating and maintaining each of the key controls in order to foster awareness of cyber risk and instil a culture of security vigilance among your workforce. Your people also act as a ‘final firewall’. For example, if for any reason a phishing email makes its way into a user’s inbox, with awareness and training, they will be able to see it for what it is and take action to keep your business secure.

Process

This involves using IT in a cybersecure way. This can look like storing data securely in the right places, having a business continuity and disaster recovery plan, and enforcing data protection best practices. An example of process in action is enforcing multi-factor authentication, which is where a user submits two pieces of authenticating information in order to log into your network or services. In this case, if a cyber threat only has access to one login device, they will not be able to get into your network and compromise your data.

Technical Defences

Technical defences are the computer-based protections that keep your business secure. This looks like antivirus software on your work devices, network firewalls, as well as network monitoring and maintenance software that constantly scan your network for anomalies and threats.

By applying the five key controls through your people, processes, and technical defences, you will be able to create a robust and encompassing cybersecurity system that protects your business from every angle of attack.

The Benefits of Cyber Essentials Certification

There are many benefits to Cyber Essentials certification for businesses, here they are in a nutshell:

Enhanced Cybersecurity

Businesses that implement the five key controls will benefit from solid protections against common cyberthreats and enjoy a network that is less vulnerable to breach attempts.

Competitive Advantage

Cyber Essentials can be a useful source of social proof for potential clients and customers, as certification against the standard will help corroborate your commitments to cyber security best practice. It is advantageous for bidding successfully for government contracts. For larger contracts and increasingly local government contracts too, Cyber Essentials is a mandatory requirement.

Legal and Regulatory Compliance

Cyber Essentials is a compliance-friendly certification that aligns organisations with regulatory frameworks such as GDPR. It empowers businesses to demonstrate that they are taking proactive measures to safeguard sensitive data.

Cost-Effective Security Measures

As Cyber Essentials is largely aimed at small and medium businesses, implementing the give key controls offers a way to for businesses to create a robust cybersecurity posture without breaking the bank. Many of the measures advocated make use of controls that businesses are already likely to have available to them.

A Foundation For Cybersecurity Maturity

Cyber Essentials offers a solid and scalable security foundation for businesses as they evolve and grow. This provides a useful base for more elaborate measures that become essential over time.

Cyber Essentials & Cyber Essentials Plus

There are two levels of certification in Cyber Essentials. One is Cyber Essentials, the other is Cyber Essentials Plus. The key difference between the two, is that Cyber Essentials is based on a self-assessment questionnaire around the five key controls. While Cyber Essentials Plus requires external verification of the implementation of the five key controls in your organisation by qualified assessors.

While both provide valuable social proof, the added benefit of Cyber Essentials plus is enhanced confidence and assurance that cybersecurity measures are effectively in place in your organisation.

How Does The Cyber Essentials Certification Process Work?

The National Cyber Security Centre (NCSC) is the authority responsible for managing the scheme. They are partnered with the IASME, which is the body that processes and assesses Cyber Essentials applications. IT support providers are also able to offer assistance with preparing for certification and implementing the five key controls.

Practically, the Cyber Essentials certification process is organised into these key steps:

Self-Assessment Questionnaire: The first step is to complete a self-assessment questionnaire provided by Cyber Essentials. This questionnaire includes questions about the organisation’s security measures and practices related to the five key controls of Cyber Essentials: Secure Configuration, Boundary Firewalls and Internet Gateways, Access Control, Patch Management, and Malware Protection.

Documentation Review: Once the self-assessment questionnaire is completed, you will need to compile relevant documentation to support the responses that you gave. This documentation can include network diagrams, policies, procedures, and evidence of security practices.

External Vulnerability Scan (Cyber Essentials Plus): For Cyber Essentials Plus certification, an external vulnerability scan will be conducted on your internet-facing systems to identify potential security weaknesses. This step is not required for standard Cyber Essentials certification.

Submission and Review: The organisation submits the completed self-assessment questionnaire and supporting documentation to a Cyber Essentials certification body or accrediting organisation.

Assessment Review: A qualified assessor reviews the self-assessment questionnaire and documentation to ensure that the organisation’s security measures align with the Cyber Essentials requirements.

Verification Testing (Cyber Essentials Plus): If you’re going for Cyber Essentials Plus certification, the assessor will conduct additional verification testing to check the effectiveness of security measures.

Certification Decision: Based on the assessment review and verification testing (CE Plus), a decision on certification is made. If your security measures meet the Cyber Essentials requirements, you will be awarded the Cyber Essentials certification.

Certificate Issuance: After verifying that your organisation meets the assessment criteria, you will receive a Cyber Essentials certificate which can be used to demonstrate your commitment to cybersecurity best practices to clients, partners, and customers.

Bear in mind that Cyber Essentials certification is not a one-time achievement; it needs to be renewed annually to ensure ongoing adherence to the five key controls. Renewal involves updating the self-assessment questionnaire and re-submitting the required documentation for review.

In the next parts of our practical guide, we will walk you through each of the key controls and how they can be implemented.

Get your FREE cyber risk traffic light report

Our Cyber Risk Traffic Light Report is designed to help businesses audit their cyber security posture, enabling them to find risks areas and security gaps and to address them with actionable insights. Get started with your cyber security journey by getting your own Cyber Risk Traffic Light Report today, click the link or fill out the form below.