Understanding Cyber Essentials Plus

Cameron Lewis I 31st October 2024

‍

In a previous article, we explained an overview of Cyber Essentials and how the self-assessment process works. The next step in completing your Cyber Essentials self-assessment is to explore the Cyber Essentials Plus certification. This is the technical verification of your self-assessment and demonstrates that your organisation has correctly implemented the Cyber Essentials controls.  

What is Cyber Essentials Plus?

Cyber Essentials Plus is an advanced cybersecurity certification designed to help organisations protect themselves against common cyber threats. It builds upon the foundational Cyber Essentials certification, which outlines basic cyber security measures that every organisation should implement. Cyber Essentials Plus provides a more rigorous evaluation, requiring organisations to undergo an independent assessment to validate their cybersecurity practices.

Key Features of Cyber Essentials Plus

1. Independent Assessment: Unlike the basic Cyber Essentials certification, which involves a self-assessment questionnaire, Cyber Essentials Plus requires a thorough external audit. This ensures that the organisation’s cyber security measures are implemented and functioning as intended.

2. Focus on Five Key Controls: The certification framework is centred around the same five critical areas known as the "Cyber Essentials Controls" of the same five critical areas. More information about these can be found in our previous article.

• Secure Configuration: Ensuring that systems are securely configured to reduce vulnerabilities.

• Boundary Firewalls and Internet Gateways: Protecting the network from external threats through properly configured firewalls.

• Access Control: Implementing strict access controls and limits on who can access sensitive information and systems.

• Malware Protection: Deploying measures to detect and prevent malware threats.

• Patch Management: Regularly updating software and systems to address known vulnerabilities.

Benefits of Cyber Essentials Plus

1. Enhanced Security Posture: Adhering to the Cyber Essentials Plus framework can significantly bolster organisations' defences against cyber-attacks. The comprehensive assessment helps identify and remediate vulnerabilities.

2. Improved Customer Confidence: Certification demonstrates a commitment to cyber security, enhancing customer confidence and loyalty. It assures clients that their data is protected against potential breaches.

3. Regulatory Compliance: Most organisations must comply with data protection regulations. Cyber Essentials Plus can help demonstrate compliance with these requirements, mitigating the risk of legal penalties.

4. Market Advantage: Cyber Essentials Plus certification can give organisations a competitive edge in the marketplace as cyber security becomes increasingly important.

5. Access to Cyber Insurance: Some insurers require organisations to have recognised cybersecurity certifications like Cyber Essentials Plus before providing coverage. Achieving this certification can facilitate better insurance options.

6. Recognition and Trust: Achieving Cyber Essentials Plus certification signals to clients, partners, and stakeholders that an organization takes cybersecurity seriously. It builds trust and can be a deciding factor in securing contracts, especially in sensitive data sectors.

How to Achieve Cyber Essentials Plus Certification

1. Preparation: Organisations should start by assessing their current cyber security measures against the Cyber Essentials framework. This involves identifying gaps and implementing necessary controls.

2. Self-Assessment: The Cyber Essentials self-assessment questionnaire must be completed before starting the Cyber Essentials Plus process. This also helps gauge readiness for the more rigorous Cyber Essentials Plus assessment. Once you have completed the Cyber Essentials Plus certification, there is a three-month window in which companies must complete it.

3. Choose an Assessor: Engage a certification body accredited to conduct Cyber Essentials Plus assessments. The body should guide you through the process and perform the required audit.

4. Undergo the Assessment: The chosen assessor will evaluate the organisation’s cyber security practices. This includes testing systems, reviewing policies, and ensuring compliance with the five key controls.

5. Certification: If the organisation meets all requirements, it will be awarded the Cyber Essentials Plus certification. Organisations must maintain their cyber security measures and undergo annual assessments to retain certification.

Conclusion

Cyber Essentials Plus is a vital certification for organisations aiming to enhance their cybersecurity defences and demonstrate a commitment to protecting sensitive information. By following the Cyber Essentials framework and undergoing an independent assessment, organisations can improve their security posture and gain a competitive advantage in an increasingly digital world. As cyber threats evolve, achieving and maintaining Cyber Essentials Plus certification is a proactive step toward securing a safer future for businesses and their clients.

‍