In 2012, the UK Government launched the 10 Steps to Cyber Security guide which urged public and private organisations to consider their cyber security measures and determine whether or not they were managing their potential risks adequately. The guide raised awareness among business owners and company boards who were encouraged to take ownership of their potential cyber threats and incorporate any solutions and policies into their business operations.

However, the UK Government’s analysis of continuing cyber attacks and feedback from the cyber security industry was that a number of security controls were still not being implemented. With a remit to tackle cyber crime and a desire to make UK one of the most secure places in the world to do business, the UK Government created the Cyber Essentials Scheme.

The Cyber Essentials scheme is a cyber security standard, which organisations can be assessed and certified for and identifies the security controls that an organisation must have in place within their existing systems. This ensures they have the confidence in delivering their cyber security effectively while managing the risk from internet-based threats.

There are 5 standards of the Cyber Essentials Scheme that organisations need to acheive in order to be certified.

5 Cyber Essentials Control Categories

  • Firewall Security

    A securely configured firewall should be in place between the Internet and your internal network and reviewed on a regular basis.

  • Secure Configuration

    Your devices and any installed software should be setup securely with strong passwords to prevent them from being compromised by a malicious user, hack or virus.

  • User Access Control

    Access to data should be tightly controlled from correctly assigned user accounts while administration privileges and rights only being assigned to users who have a genuine business need for access.

  • Malware Protection

    A conventional but robust anti-malware solution should be installed to prevent your devices from being infected with malicious software.

  • Patch Management

    Any ongoing security vulnerabilities, updates and patches should be applied to devices and software.

There are 2 Types Of Cyber Essentials Certification

Cyber Essentials

Cyber Essentials

Cyber Essentials demonstrates a basic but sound understanding of cyber security within an organisation. The assessment process involves a self assessment questionnaire being completed to acknowledge that the required controls are in place.

Once submitted, an accredited Cyber Essentials assessor will examine the responses to ensure they meet the standards of the NCSC (National Cyber Security Centre). Once successful, the Cyber Essentials certification is awarded.

Cyber Essentials Plus

Cyber Essentials Plus

Cyber Essentials Plus builds on the standards and security protocols which form part of the Cyber Essentials certification.

However, it includes an in depth assessment that is conducted at your premises and requires your organisation to already have the Cyber Essentials certification.

It also involves a number of specific tests which are designed to validate that a list of requirements with each of the five control categories are employed correctly.

By: Digital Chimps Support Knowledge Base, Security Related: