Cyber Essentials

A firewall should be in place between the Internet and your organisation’s internal network. This firewall should be securely configured and be reviewed regularly.

Devices and software should be configured securely to prevent them from being compromised by a malicious user or malware. Default passwords should be changed, and all passwords should be suitably complex to prevent them from being guessed. All unnecessary software should be removed from end-user devices.

Access to your organisation’s data should be controlled through correctly assigned user accounts. Administration privileges should be tightly controlled, and administrative rights should only be granted to users who have a genuine, business need for this level of access.

A robust anti-malware solution should be applied to prevent servers and end-user devices from being infected with malicious software. Cyber Essentials allows this to be achieved through conventional anti-virus software, application white-listing or by running applications in “sandboxed” environments.

All security updates and patches should be applied to devices and installed software. This ensures that security vulnerabilities are fixed and reduces the likelihood of devices and applications being compromised by a malicious user or malware.

Cyber Essentials certification demonstrates a base-level appreciation of cyber security within your organisation. The assessment process comprises of an online questionnaire being completed by the organisation, which captures information that supports the five controls being in place.

Once the questionnaire has been submitted, an accredited Cyber Essentials assessor examines the responses to ensure that these are line with the list of requirements produced by the NCSC (National Cyber Security Centre). If successful, the organisation will be awarded Cyber Essentials certification.

Cyber Essentials Plus builds on the requirements that are mandated by the Cyber Essentials certification and includes an active assessment that is conducted at your organisation’s premises.

The Cyber Essentials Plus assessment requires that organisations already have Cyber Essentials certification and includes a number of specific tests which validate that a subset of the five control categories are implemented correctly.

A vulnerability assessment is conducted against your organisation’s Internet-facing services. This is to ensure there are no vulnerabilities present in these services, which could allow them to be compromised by an Internet-based attacker.

An automated patch audit is conducted on your internal servers and workstations. This is to ensure that all critical-rated patches have been applied.

A configuration review is conducted of your anti-malware solution, to ensure that it has been installed correctly and offers a high degree of protection.

A test is conducted to assess if malicious files can be sent into your organisation through email attachments. This is achieved by sending a small number of malign, test files into some of your organisation’s email accounts from our server.

A test is conducted to assess if malicious files can be downloaded by your users from a potentially malicious server on the Internet. This is achieved by attempting to download a small number of malign, test files from our server to some of your organisation’s workstations.

Obtaining Cyber Essentials certification provides assurance to your customers & stakeholders that your organisation has a baseline appreciation of cyber security. Cyber Essentials is a requirement for many UK public sector contracts, therefore achieving Cyber Essentials certification increases your eligibility to tender for sales into UK government departments.

Organisations who are awarded Cyber Essentials and Cyber Essentials Plus certification are provided with a certificate from our Accreditation Body and a logo toolkit which allows the Cyber Essentials logos to be used on the organisation’s website and in company documentation.

Displaying the Cyber Essentials logo to your customers and prospects provides a visible way to instil confidence in your organisation’s compliance with a recognised cybersecurity standard. It is also possible for customers to verify your Cyber Essentials certification through the NCSC website, therefore providing an additional layer of authenticity to your certification.