What is Cyber Essentials / Cyber Essentials Plus Certification?
Cyber Essentials represents the UK Government’s minimum baseline standard for cyber security for organisations of all sizes in the UK. The annually renewable certification scheme is aligned to five technical criteria designed to stop the most common cyber security threats.
Cyber Essentials certification demonstrates that an organisation is protecting itself by implementing key cyber security controls. The scheme is regularly reviewed to ensure it stays effective in a constantly evolving threat landscape.
There are two levels of certification and both include a self-assessment, the questions for which are available to download for free in advance. Whilst the first level is purely self-assessment, the second level includes an audit conducted by a certified assessor.
The 5 core controls examined in both Cyber Essentials and Cyber Essentials Plus are:
- User access control
- Secure configuration
- Security update management
- Firewalls and routers
- Malware protection
Cyber Essentials Plus
Once your organisation has passed the basic level, it can apply for Cyber Essentials Plus, which is based on the same technical criteria as Cyber Essentials.
Key Differences between Cyber Essentials and Cyber Essentials Plus
- Level of Assessment
- Cyber Essentials: This certification relies on a self-assessment questionnaire. The business completes the questions based on its current cybersecurity practices, but there is no independent verification of the information provided.
- Cyber Essentials Plus: Unlike the basic version, Cyber Essentials Plus includes an independent, hands-on audit covering a representative set of user devices, all internet gateways, and all servers with services accessible to the internet.
- Validation Method
- Cyber Essentials: The validation method is straightforward, where organisations self-assess and submit their responses for approval. The certification process is generally quicker because it does not require any external testing.
- Cyber Essentials Plus: The validation method is more comprehensive and organisations are subjected to real-world testing. Independent certified assessors conduct internal and external vulnerability scans and penetration testing.
- Cyber Essentials: The self-assessment validation process makes the cost an affordable entry point for smaller organisations looking to enhance their cybersecurity position.
- Cyber Essentials Plus: Since it involves additional testing and verification by a third party, the cost of Cyber Essentials Plus is higher.
- Certification Scope
- Cyber Essentials: Entry-level certification for organisations looking to demonstrate their commitment to cybersecurity.
- Cyber Essentials Plus: Certification provides more confidence as it shows that an organisation’s security measures are actively tested and work effectively. It is typically suitable for larger organisations, those with more complex IT infrastructures or those that handle sensitive data that require a more in-depth cybersecurity assessment.
- Ongoing Monitoring
- Cyber Essentials: Certification is valid for 12 months. Thereafter a further self-assessment is required to renew the certification.
- Cyber Essentials Plus: Certification is also valid for 12 months. However, because the process is more rigorous, the renewal process typically includes updated testing and verification to ensure cybersecurity measures remain robust.
The Key Benefits of Cyber Essentials and Cyber Essentials Plus
Cyber Essentials:
- Cost-effective: Cyber Essentials is an affordable starting point for many businesses.
- Quick Certification Process: The self-assessment is simple to complete, which means certification can be obtained quickly.
- Protection Against Common Cyber Threats: It focuses on addressing basic cybersecurity vulnerabilities that all organisations should be aware of.
- Improved Reputation: Certification helps demonstrate an organisation’s commitment to cybersecurity, essential for clients, partners, and stakeholders.
Cyber Essentials Plus:
- Enhanced Security Confidence: Independent verification offers greater assurance that security measures are effective and that the business is complying with the scheme.
- Better Protection Against Threats: As the testing involves simulated cyberattacks, Cyber Essentials Plus helps identify vulnerabilities that could be missed in the self-assessment.
- Improved Competitive Edge: As a more advanced certification, Cyber Essentials Plus can help differentiate an organisation as a cybersecurity leader in a given industry.
- Client Trust: If clients, vendors or supply chain partners require a higher level of cybersecurity assurance as part of an agreement, Cyber Essentials Plus is more likely to fulfil those requirements.
How we can help at Comprendo
Both levels of Cyber Essentials accreditation help to mitigate cyber risks and will bolster your organisation’s reputation as a secure business to deal with. At Comprendo we can help prepare your business for evaluation and put in place the security measures your business needs to become accredited.
If you choose to work with us, we will install the Cyber Essentials ISO 27001 management portal and Cybersmart software, which automatically filters data from your cyber security controls into the Cyber Essentials platform. The software ensures all infrastructure meets the required security criteria and will report on areas requiring improvement.
For example, an operating system which is no longer supported (ie, too old for secure usage) will be flagged. Cybersmart also includes security learning modules for your employees to complete to help them identify cyber threats on their own devices.
>> Call us on 0345 527 4394 for an informal chat with one of our knowledgeable support team
>> Email us at: info@comprendo.co.uk
At Comprendo, we provide customer-focused IT services, solutions and support to businesses throughout North and West Yorkshire, Lancashire and beyond, including Leeds, Bradford, Harrogate, York, Preston and Manchester. Looking to outsource your IT or review your cyber security? We look forward to hearing from you.
