A Summary of the Cyber Essentials Scheme
In 2012, the United Kingdom Government launched the '10 Steps to Cyber Security', guide, urging public and private organisations to consider their cyber security measures, to determine if they are managing their potential risks adequately.
- Home
- Knowledge Base
- A Summary of the Cyber Essentials Scheme
The guide raised awareness among business owners and company boards, encouraging them to take ownership of any potential cyber threats and incorporate any solutions and policies into their operations.
10 Steps to Cyber Security
- Information Risk Management Regime:
Assess and govern risks to business assets with the same scrutiny as financial or operational risks. - Secure Configuration:
Define and manage baseline security builds for all ICT systems. - Network Security:
Protect connections to untrusted networks like the internet. - Managing User Privileges:
Limit user access rights and privileges, strictly to what jobs require. - User Education and Awareness:
Train staff and enforce clear acceptable-use security policies. - Incident Management:
Build capabilities for response, disaster recovery and business continuity. - Malware Prevention:
Implement policies and defences against malicious software across vulnerable processes. - Monitoring:
Set up strategies to detect unauthorised or malicious activity. - Removable Media Controls:
Control and restrict the use of USB drives and external media. - Home and Mobile Working:
Develop secure remote working policies for mobile devices.
Introducing The Cyber Essentials Scheme
However, the UK Government’s analysis of continuing cyber attacks and feedback from the cyber security industry, was that a number of security controls were still not being implemented. With a remit to tackle cyber crime and a desire to make the UK one of the most secure places in the world to do business, the 'Cyber Essentials Scheme', was created.
The Cyber Essentials Scheme is a cyber security standard, created by the National Cyber Security Centre, where organisations can be assessed and certified to identify the security controls that an organisation must have in place within their existing systems. This ensures they have the confidence in delivering their cyber security effectively, while managing the risk from internet-based threats.
To be certified, there are 5 standards of the Cyber Essentials Scheme that organisations need to achieve.
5 Cyber Essentials Control Categories
- Firewall Security:
A securely configured firewall should be in place between the Internet and your internal network, which should be reviewed on a regular basis. - Secure Configuration:
Your devices and any installed software should be setup securely with strong passwords, to prevent them from being compromised by any malicious users, hacks or viruses. - User Access Control:
Access to data should be tightly controlled from correctly assigned user accounts, with administrative privileges and rights only being assigned to users who have a genuine business need for access. - Malware Protection:
A conventional but robust anti-malware solution should be installed to prevent your devices from being infected with malicious software. - Patch Management:
Any ongoing security vulnerabilities, updates and patches should be applied to devices and software.
Cyber Essentials
The 'Cyber Essentials', certification demonstrates a basic but sound understanding of cyber security within an organisation. The assessment process involves a self assessment questionnaire being completed to acknowledge that the required controls are in place.
Once submitted, an accredited Cyber Essentials assessor will examine the responses to ensure they meet the standards of the National Cyber Security Centre. Once successful, the Cyber Essentials certification is awarded.
Cyber Essentials Plus
The 'Cyber Essentials Plus', certification builds on the standards and security protocols which form part of the 'Cyber Essentials', certification.
However, it includes an in depth assessment that is conducted at the business premises and requires the organisation to already have the 'Cyber Essentials', certification.
It also involves a number of specific tests which are designed to validate that the list of requirements, or five control categories, are being deployed and managed correctly.
In Summary
The 'Cyber Essentials Scheme', is the minimum standard of cyber security recommended by the UK Government for organisations of all sizes, which has been developed by experts at the National Cyber Security Centre.
Related Information
To understand and learn more, the following information and related resources are available within our Knowledge Base.
Further Information, Websites & Links
The following websites and links provide further information and resources if you would like to learn more.
