Cyber Essentials is a UK government scheme created to protect organisations of any size against some of the most prevalent cyber attacks, which often take the form of basic exploits that mimic physical attacks, like someone checking your front door to see if it’s unlocked. For cyber essentials certification purposes, an accredited assessment body must be chosen; you can find a list of these on IASME’s website.
Self-assessment option
The cyber essentials scheme is a UK-based certification scheme that helps organisations protect themselves against common cyber attacks. Backed by the government and overseen by the National Cyber Security Centre, certification requires an easy self-assessment and an annual review to maintain certification status.
The basic version of the scheme costs between £300 and £500 plus VAT and offers protection from various cyber attacks. It includes both an online self-assessment and an external vulnerability scan to assess and protect against vulnerabilities. Unfortunately, for organisations without an extensive cyber security background, this process can be complex. To help navigate it, there are numerous certified CES assessors who can offer advice from expert sources.
Before April 2020, self-assessments only included external vulnerability scans; since April 2022, this has been expanded to include internal vulnerability scanning as well. This ensures that basic security controls have been put in place and maintained effectively.
Importantly, Cyber Essentials should not be seen as a replacement for cyber security; rather, it should serve as a supplement. Therefore, regular penetration tests and vulnerability scans of IT infrastructure must still take place so as to identify any areas that require attention.
For organisations experiencing difficulty with self-assessments, the scheme provides a pre-assessment option—an invaluable opportunity to identify any issues prior to undertaking full assessments—that allows them to save both time and money by discovering any discrepancies before the assessment takes place. Both CES and CES Plus packages feature pre-assessments.
At this stage of your self-assessment, you will need to answer a series of questions regarding the IT systems at your organisation, which will cover five key control areas:
Answers must be accurate and up-to-date for this application to be successful, or else your submission will be unsuccessful and require resubmission. However, if your answers meet these criteria successfully, your application will be successful and awarded with a certificate that can be displayed on your website as proof. You will also be added to a list of Cyber Essentials-certified companies and be eligible for cyber insurance with insurers offering up to £25,000 in indemnity coverage (subject to terms and conditions).
On-site assessment option
If you lack the time or technical expertise necessary to conduct a self-assessment questionnaire, another option would be to pay an IT Governance CREST-accredited certification body to conduct an on-site assessment at your business premises. This assessment includes an in-depth review of IT security systems as well as an external vulnerability scan. Once complete, your business will receive a cyber essentials certificate, which proves your protection from various cyber attacks; display this on websites and marketing materials to show that cybersecurity is taken seriously by your organisation.
Cyber Essentials is an NCSC-supported scheme that helps businesses defend against most forms of cyber attacks. The scheme emphasises five primary cybersecurity principles, such as boundary firewalls and internet gateways, secure configuration, malware protection, patch management, and patch deployment, which together form an effective safeguard against data breaches often caused by a lack of basic cyber security measures.
cyber essentials certification can do more than simply reduce your risk of cyber attacks; it can help your organisation win government contracts and increase customer trust. Customers increasingly expect large organisations, particularly those vulnerable to attacks, to take security seriously. Having this certificate on display demonstrates strong security practises that may be an essential requirement of certain contracts.
To obtain Cyber Essentials certification, your organisation must register with an accredited certification body. IASME is licenced by the NCSC to certify against the Cyber Essentials scheme and has trained staff that can guide your organisation through the process of becoming certified. We also offer Infosec Partner Services, so you don’t have to go it alone!
Once registered with an accreditation body, your organisation must complete a self-assessment questionnaire (SAQ). We can assist in filling out this form and checking its compliance with scheme requirements. Once your SAQ is approved, we will perform a comprehensive audit of your IT systems. This includes selecting random samples of devices, installing software agents on them, running vulnerability tests on these agents, and compiling an easy-to-read report detailing any issues found that require action.
Renewing your certification
The cyber essentials certification will protect your business against 80% of cyber attacks, such as hacking and phishing, that are the most prevalent online threats to cybersecurity. The certification process tests five key technical controls, such as antivirus software, patching updates, firewalls, and staff training, which aim at shielding organisations against the most frequent and easily addressable cyber threats.
There are various certification bodies offering Cyber Essentials assessment services, which you can find on the IASME website and select according to the needs of your organisation. Once completed, these companies will conduct the evaluation and issue you a certificate once it is passed; certificates expire yearly so as to encourage organisations to simply implement controls in order to pass an assessment.
Organisations without enough time for self-assessments have another option to help recertify quickly and easily: IT Health offers this as one way of getting their certification renewed quickly and easily. They will take a sample of your business computers and conduct vulnerability scans against them in order to ensure they conform to Cyber Essentials standard compliance.
Re-certification will follow a five-step assessment process similar to its predecessor; however, you will have more time and space for responding to questions about cyber security processes in your business, such as password policies or protection of any sensitive data held. However, the certifying body can still conduct their assessment remotely, without visiting your office or gaining physical access to staff laptops.
Re-certification is vital, as the requirements of the scheme evolve each year. Furthermore, renewing will keep your certification listed on the public register of approved eyber essentials businesses, which is particularly important if tendering projects with local councils or government bodies that increasingly demand such certification for suppliers they work with.
FAQs
Cyber Essentials could be your perfect way to increase cyber security and become a more desirable business partner. Established in 2014, it has helped over 30,000 organisations meet basic cybersecurity hygiene practises while opening doors with government departments that require it from suppliers.
However, it’s essential to recognise that Cyber Essentials should not be seen as a replacement for ISO 27001 certification, which covers more aspects of your business. In order to obtain ISO 27001 certification successfully and on time, ensure all areas of the business have been taken into consideration prior to applying.
Starting the certification process is straightforward and painless; all it requires is submitting a self-assessment to the certifying body that will conduct your assessment, using your answers as a benchmark against which they compare your current security state. If all five essential controls have been met successfully by your business, then its assessment will pass and they will issue you a certificate.
Once your business has passed the Cyber Essentials assessment, they can proudly display their certificate on their website or add themselves to a list of compliant companies so customers can quickly locate one they trust.
Cyber Essentials provides an affordable and straightforward way to safeguard your business against cyber threats. Based out of the UK, this scheme helps both small and mid-sized enterprises protect themselves against common attacks that threaten to shut them down completely.
Attaining cyber essentials certification will demonstrate your business is taking measures to keep data secure, as well as help secure more contracts from larger clients. Trust is built with large companies that require suppliers with this certification; many may only work with suppliers that possess this type of accreditation.
Start early for maximum efficiency when applying for certification; an early application allows enough time for any necessary modifications to be implemented and changes to be implemented as soon as they become necessary. Partner with someone like LP Networks, who will guide and assist with this process by helping you understand questions related to your business and provide insight on their interpretation and relevance to it.
Sophie writes about local history and community stories, emphasizing the people, places, and events that make towns special.
