6 min read
Cyber Essentials is a simple, yet very effective scheme backed by the UK Government. It is designed to help protect companies, regardless of their size, against a huge range of cyber attacks.
Cyber attacks come in various shapes and sizes but most are incredibly basic in nature. They are typically carried out by individuals who are not skilled – this can be compared to a thief trying the front door to see if you have left it open. Cyber Essentials offers a good level of protection against these unsophisticated attacks.
In this guide we will cover:
What is Cyber Essentials?
Why Cyber Essentials?
Scope of Cyber Essentials
Cyber Essentials or Cyber Essentials Plus?
Why do I need Cyber Essentials?
What happens if you’re not covered?
Requirements for boundary firewalls and internet gateways
Requirements for secure configuration
Requirements for malware protection
Requirements for patch management
How long does it take to become Cyber Essentials certified?
Launched in 2014 by the Department for Business, Innovation and Skills, this Government scheme encourages businesses to protect their data from the most common threats online. The scheme was developed in conjunction with the Information Security Forum, the Information Assurance for Small and Medium Enterprises (IASME) Consortium, the British Standards Institution and various industry partners.
Watch the video about to understand why businesses get Cyber Essentials certified.
Not only does it show a business’ ability to keep data protected but also there are other benefits. Being Cyber Essentials certified gives a big advantage when it comes to bidding for Government contracts. It has also been suggested by insurers that being certified could lead to lower insurance premiums. By carrying out the measures, you show that you’re protected against common cyber attacks. It’s also a great accreditation to display on your website, showing your clients, you’re protecting their data.
If you are looking to secure your supply chain, NCSC provide a very useful tool to search for companies that are Cyber Essentials certified. Remember, Cyber Essentials certification only lasts 12 months, so consider reviewing your supplier's security annually.
On the flip side your company, too, can be easily found by potential clients:
Cyber Essentials covers five core areas to provide a basic level of protection against cyber-attacks:
There are two certification options to choose from:
There are many reasons why you might want to gain Cyber Essentials accreditation for your business:
Your business may be left vulnerable and open to attack without the basic protection included in Cyber Essentials.
Many believe that criminals only target big companies, but this is not the case. Smaller businesses may be consciously targeted because of their limited budget and not having the tech required to put up adequate defences.
Ultimately, it is important because it can provide customers peace of mind and confidence to work with your company safely. Cyber Essentials is the best and easiest way to show that you meet an industry standard and it may even help you to win more customers.
Ensure that only safe and necessary network services can be accessed from the Internet. Default configurations are very rarely strong enough to protect against cyber-attacks. Hackers will often know ways around default configurations, putting your networks at risk.
When new equipment is bought, it is important to alter the settings. Manufacturers of computers and other equipment will have a default setting that will normally enable the new user access to absolutely everything. In terms of cybersecurity, this is not best practice. As a general rule, only allow employees access to what they need. Remember, if a device is stolen, if the user only has limited access, then less damage can be done by the criminal.
This means you will need to:
Setting have been altered to the individuals needs and privileges have been checked.Adapt the settings to the users needs. Only allow access to what the team member needs. IT administrator rights should only be accessible to the few people that need it. Extra permissions are only be given to those who need them.
All devices where company data can be accessed, whether it be your laptop phone or IoT device should have a password. The password should be unique and hard to guess. It's important to remember that default passwords, like 'password' or your company name are easy for hackers to guess.
We would recommend 2FA for all accounts, whether it be your social accounts or CRM. What this means is, when you log on, you will be asked for your password like normal - that's the first authentication. But then you may get another code texted to your mobile. That would be the second factor authentication.
To ensure that employees and suppliers only have access to the administration privileges that they need and control what can be accessed.
Another requirement for secure configuration is a well-implemented password policy.
Ensure that computers and network devices are properly configured to reduce the level of inherent vulnerabilities and provide only the services required to fulfil their role. Default configurations are very rarely strong enough to protect against cyber-attacks. Hackers will often know ways around default configurations, putting your networks at risk.
Tick off list
There are three main sections of requirements when it comes to malware protection:
Sandboxing is a holding system that prevents access from applications etc. until that access has been approved by a user. This includes:
Objective — Restrict execution of known malware and untrusted software, to prevent harmful code from causing damage or accessing sensitive data. Software updates are now more important than ever. They remove potential vulnerabilities on your network, in turn making you more cyber secure.
There are three rules for software and applications for patch management when it comes to Cyber Essentials:
Objective — Ensure that devices and software are not vulnerable to known security issues for which fixes are available.
There’s no definitive answer to this question. If you have all the controls already in place and pass the assessment first time, you could be certified in a week. On the other hand, if you have to make several changes to your systems to become compliant, it could take several months.
The Cyber Essentials assessment is ran by IASME Consortium, having won a five year contract with Cyber Essentials in April 2020. You can find out more about the certification on the NCSC website.
If you are interested in becoming Cyber Essentials certified, but don't have security expertise inhouse, we can help. Visit our Cyber Essentials Consultancy webpage for details. Our security expert, Mark Poulding has also created a number of videos running through IASME Cyber Essentials frequently asked question.
Mark Poulding : 29-Jul-2021 09:25:00
Many businesses turn to their IT company to help them pass Cyber Essentials accreditation. The National Cyber Security Centre (NCSC) recently...
Mark Poulding : 08-Mar-2022 16:30:00
IASME Cyber Essentials was introduced by the UK Government to help small businesses tackle cyber threats and prove to their customers and clients...
Understanding the risks of cyber threats to your business, enables you to it place the right level of cybersecurity controls to your business. Even...
