Understand what Cyber Essentials checks, the difference between Cyber Essentials and Plus, common failures, and how to prepare for certification.
If you're looking at Cyber Essentials certification for your business, there's a good chance you've been asked for it by a customer, insurer, tender or supply chain.
But Cyber Essentials shouldn't just be a box-ticking exercise.
At its core, Cyber Essentials gives your business a recognised baseline for cyber security. It helps you identify gaps in your IT security and demonstrate that fundamental protections are in place across your organisation.
At AnyIT, we help UK businesses prepare for Cyber Essentials and Cyber Essentials Plus certification, including identifying what needs fixing before the assessment begins.
Cyber Essentials is a UK Government-backed cyber security certification scheme designed to protect organisations against common cyber attacks.
Think of it a little like an MOT for your IT.
Without testing your business against a defined standard, you don't necessarily know where the gaps are. Cyber Essentials provides a framework against which your existing IT security can be assessed.
That means looking at areas such as:
The objective isn't to claim that your business can never suffer a cyber attack. It's to make sure the basic doors and windows aren't being left open.
There are two levels of certification:
Cyber Essentials is primarily a self-assessment process. Your organisation answers questions about its IT environment and the technical security controls it has in place. Those answers are then submitted for assessment and certification.
Cyber Essentials Plus builds on the same requirements but adds independent technical verification.
Rather than simply declaring that the required controls are in place, an independent assessor tests your environment to verify that those controls are actually working.
For organisations wanting a higher level of assurance — or where customers and tenders specifically require it — Cyber Essentials Plus provides much stronger independent verification.
Cyber Essentials can be valuable for almost any UK organisation that stores or processes business data. However, we particularly see businesses looking for certification because they:
A tender may be the catalyst that starts the process, but we'd recommend treating certification as an opportunity to improve security across the organisation rather than doing the minimum necessary to obtain a certificate.
There are several important areas to consider.
Your network boundary needs to be properly protected. That includes checking routers, firewalls, remote-access systems, administrative interfaces and other services that could potentially be reached from the internet.
Default passwords need to be removed and unnecessary internet-facing services should be disabled. If something doesn't need to be accessible from the public internet, ideally it shouldn't be.
Over time, IT environments accumulate old software, unused accounts, unnecessary applications and configuration changes. These can create security weaknesses.
Cyber Essentials encourages businesses to maintain secure configurations, remove things they no longer need and reduce the number of potential ways an attacker could gain access.
An old user account that nobody remembers, for example, can become a serious problem if its password is compromised.
Keeping software and devices properly patched is a fundamental part of Cyber Essentials. When a critical vulnerability is identified by a software vendor, relevant security updates need to be deployed within the required timeframe.
This means businesses need more than somebody occasionally clicking “update”. You need to know:
This is one of the areas where proper managed IT systems make Cyber Essentials considerably easier to maintain.
Multi-factor authentication is now an extremely important part of Cyber Essentials.
Where MFA is available for an in-scope cloud service, it needs to be appropriately enabled in accordance with the Cyber Essentials requirements.
This is particularly relevant because modern businesses store huge amounts of information in cloud applications. Microsoft 365 is an obvious example, but businesses may also use accounting platforms, CRM systems, file-sharing platforms and dozens of other cloud applications.
Protecting a laptop while leaving a cloud account secured by nothing more than a reusable password doesn't make much sense.
Cyber security is no longer just about the computers sitting inside your office. Modern organisations may have critical business information spread across:
These services need to be considered when establishing the scope of your Cyber Essentials assessment. Getting the scope right at the beginning is extremely important.
In most cases, our preference is to approach Cyber Essentials across the whole organisation.
It may be possible to certify a particular scope rather than everything the organisation operates, but that scope needs to be properly defined and justified.
If the only objective is to get a certificate so you can submit a tender, it can be tempting to make the scope as narrow as possible.
If you're going through the effort of achieving Cyber Essentials, use the process to improve security throughout the business. The certificate is useful. The security improvements behind the certificate are more important.
Some of the issues we regularly look for when preparing an organisation include:
Often, Cyber Essentials preparation isn't about buying lots of new cyber-security products. It's about understanding your environment and making sure the security controls you already have are configured and managed correctly.
For a well-managed IT environment, Cyber Essentials shouldn't be frightening. The difficulty normally comes from discovering things that haven't been properly managed over time.
That's why we'd rather identify those issues before you submit your assessment.
We can review your environment against the Cyber Essentials requirements, identify gaps, help remediate them and then support you through the certification process.
If you're aiming for Cyber Essentials Plus, we can also help prepare your environment for the independent audit.
Cyber Essentials certification is valid for 12 months, so maintaining compliance is important.
Passing once and then forgetting about it for a year isn't a particularly good security strategy. Your IT environment changes constantly: new employees join, people leave, laptops are replaced, applications are installed and new cloud services are introduced.
The objective should therefore be to stay Cyber Essentials ready, rather than scrambling to fix everything shortly before renewal.
AnyIT helps businesses understand, prepare for and achieve Cyber Essentials and Cyber Essentials Plus certification.
We can help with:
Whether you're starting from scratch, have failed an assessment, or have been told you suddenly need Cyber Essentials for a tender, we can help you understand exactly what needs to happen.
AnyIT is a managed IT service provider based in Needham Market, Suffolk, trading since 2005. Call 01449 798088, email info@anyit.com or use our contact page.
Managed IT support is £85 per seat per month with a £400 monthly minimum. We support 200+ Suffolk businesses since 2005, deliver 99.9% uptime and commit to a 30-minute first response for major incidents with 24/7 monitoring.