Cyber security can quickly become complicated.
From phishing emails and compromised accounts to malware, outdated software and vulnerable devices, businesses have an increasing number of risks to manage. But improving your cyber security doesn’t always have to begin with complex technology or major investment.
Sometimes, getting the fundamentals right is the most important step.
That’s exactly what Cyber Essentials is designed to do.
As businesses across the UK mark Cyber Security Awareness Month, it’s a good opportunity to look at what Cyber Essentials and Cyber Essentials Plus actually mean, how they differ and why certification could form an important part of your wider cyber security strategy.
What is Cyber Essentials?
Cyber Essentials is a UK Government-backed certification scheme designed to help organisations protect themselves against common cyber threats.
Cyber Essentials certification is achieved through a self-assessment questionnaire, giving organisations a structured way to review their cyber security against the scheme’s requirements.
Rather than trying to account for every possible cyber-attack, the certification focuses on five fundamental technical controls:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
These five controls are designed to help organisations protect themselves against the most common internet-based cyber security threats.
For many organisations, that’s precisely where its value lies.
It provides a structured starting point for examining how devices, software, accounts and networks are protected rather than leaving businesses to work out where to begin with cyber security themselves.
But Cyber Essentials is only one level of certification.
What about Cyber Essentials Plus?
Cyber Essentials Plus is based around the same core security controls, but introduces additional independent technical testing.
While Cyber Essentials involves an organisation assessing its controls through a verified self-assessment, Cyber Essentials Plus involves a technical audit of systems by a qualified assessor.
That additional testing provides a greater level of assurance that the controls aren’t simply documented, but are operating effectively within the organisation.
Put simply:
- Cyber Essentials asks whether the right foundations are in place.
- Cyber Essentials Plus independently tests those foundations.
For organisations handling sensitive information, entering supply chains or simply looking for greater confidence in their security, that extra level of assurance can be particularly valuable.
More Than a Certificate
Cyber Essentials shouldn’t be viewed as the end of an organisation’s cyber security journey.
Cyber threats change, businesses evolve and new technology is continually introduced. New employees, software, devices and cloud services can all alter an organisation’s risk profile over time.
Certification instead provides a strong foundation from which businesses can continue developing their cyber security.
That might include measures such as staff cyber awareness, vulnerability assessments, penetration testing and broader security monitoring.
Related Article
We’ve previously explored penetration testing and how it can be a logical next step following Cyber Essentials certification.
Cyber security is not something businesses simply complete once.
It’s an ongoing process of understanding risk, strengthening controls and adapting as your organisation changes.
Cyber Essentials or Cyber Essentials Plus?
The right level will depend on your organisation and what you’re trying to achieve.
For businesses beginning to formalise their approach to cyber security, Cyber Essentials can provide a clear framework for establishing the fundamentals.
Cyber Essentials Plus goes further by independently testing those same controls, providing additional assurance around the security measures already in place.
Whichever route is appropriate, the important thing is taking that first step.
Because cyber security doesn’t need to begin with the most complicated solution available. It begins with understanding where you’re vulnerable and putting the right protections in place.
Supporting Your Cyber Security Journey
At Converged, we know cyber security isn’t a single product or one-off exercise. It’s an ongoing process involving the right technical, procedural and cultural measures to strengthen your organisation’s resilience.
As a Cyber Essentials Plus Assessor and Certifying Body, Converged can support organisations taking that step towards certification, while also helping businesses look beyond the certificate at their wider cyber security requirements.
Whether you’re considering Cyber Essentials, Cyber Essentials Plus or looking more broadly at your organisation’s cyber security, our team can help you understand the right next steps.
This Cyber Security Awareness Month, take the opportunity to strengthen your cyber security foundations.
Speak to the Converged team about Cyber Essentials and the next steps for your organisation’s cyber security.
