About Cyber Essentials

Cyber Essentials helps you to guard your organisation against cyber attack.

Cyber Essentials helps you to guard against the most common cyber threats and demonstrate your commitment to cyber security.

Cyber Essentials represents the UK Government’s minimum baseline standard for cyber security for organisations of all sizes in the UK. The annually renewable certification scheme is aligned to five technical controls designed to prevent the most common internet-based cyber security threats.

Cyber Essentials certification demonstrates that an organisation is protecting itself by implementing the most important cyber security controls.  A team of experts review the scheme at regular intervals to ensure it stays effective in the ever-evolving threat landscape.

Cyber Essentials certification includes automatic cyber liability insurance for any UK organisation who certifies their whole organisation and has less than £20m annual turnover. At the first level of Cyber Essentials, organisations assess themselves against five basic security controls and a qualified Assessor verifies the information provided.

All the self-assessment questions are available to download for free in advance. Once you have passed Cyber Essentials you can apply for Cyber Essentials Plus, which is a hands-on audit of your systems. Read on for more info.

There are two levels of certification:

Cyber Essentials

Our self-assessment option gives you protection against a wide variety of the most common cyber attacks. This is important because vulnerability to basic attacks can mark you out as target for more in-depth unwanted attention from cyber criminals and others.

Certification gives you peace of mind that your defences will protect against the vast majority of common cyber attacks simply because these attacks are looking for targets which do not have the Cyber Essentials technical controls in place.

Cyber Essentials shows you how to address those basics and prevent the most common attacks.

Cyber Essentials Plus

Cyber Essentials Plus still has the Cyber Essentials trademark simplicity of approach, and the protections you need to put in place are the same, but for Cyber Essentials Plus a hands-on technical verification is carried out.

Alternatively you can familiarise yourself with cyber security terminology, gaining enough knowledge to begin securing your IT.

Certified cyber security

• Reassure customers that you are working to secure your IT against cyber attack
• Attract new business with the promise you have cyber security measures in place
• You have a clear picture of your organisation's cyber security level
• Some Government contracts require Cyber Essentials certification

It is a question we are often asked, “does a business still need Cyber Essentials certification if they have ISO 27001?”. Businesses sometimes presume that if they have undergone ISO 27001 certification they will not need the seemingly less complex Cyber Essentials controls.

The reality is, Cyber Essentials can still be very beneficial for companies who hold ISO 27001.

At its heart, ISO27001 is a risk management certification. This means that an organisation decides, after examining its information security risks, which security controls they are going to implement. The organisation may choose to put in place a different set of controls to those in Cyber Essentials and may decide to accept the risk of not implementing certain Cyber Essentials controls.

This becomes particularly important when looking at risk management within a supply chain. Cyber Essentials is a prescriptive standard, and so it gives more confidence to the person responsible for procurement that a business has implemented the five specific controls that are part of the standard.

If a business only has ISO 27001 they may have made a risk-based decision on whether to implement the controls and could have taken a management decision to accept a high technical risk without full knowledge of the security consequences. We have seen companies, for example, decide not to patch their systems within 14 days because of a decision made by management.

In the real world we see lots of companies with ISO27001 trying to achieve Cyber Essentials and they often struggle to achieve it.

This is why Cyber Essentials certification is often mandated throughout a supply chain regardless of ISO27001 certification.

Additional information can be found at the "The National Cyber Security Centre (NCSC)" website