CYBER ESSENTIALS

Cyber Essentials Certification Benefits

Through certifying against the Cyber Essentials scheme, organisations are able to:

• promote and demonstrate that they have undertaken essential precautions in minimising their cyber risk.
• satisfy client, suppliers, insurers and industry regulators including businesses tendering for government contracts.
• gain assurance of the security posture of their systems IT systems and networks.

For further information on the scheme and it’s benefits please see https://www.cyberessentials.ncsc.gov.uk/getting-certified/

Cyber Essentials Assessment Areas

The primary security controls that are assessed during a Cyber Essentials or Cyber Essentials plus are:

• Internet Perimeter Security – establishing the exposure of Internet facing systems, presence of appropriately secure firewall controls and security posture of those systems.
• Access and Authentication Controls – validation of appropriate authentication mechanism to protect an organisation’s application or infrastructure from unauthorised access.
• Security Patch Management – verification of the application of security patches across Operating system and application.
• Malware and Endpoint Protection – a review of the presence and effectiveness of anti-virus and endpoint protection solutions.
• Secure Configuration – checks to ensure systems are configured in the most secure way and common vulnerabilities through implementation weaknesses have been addressed.

Cyber Essentials vs Cyber Essentials Plus

Both schemes consist of the same core cyber security assurance activities however the Cyber Essentials Plus assessment includes additional checks and provides a greater depth and breadth of the cyber security posture of an organisation providing an enhanced certification and greater peace of mind.

• Self-assessment Questionnaire – The organisation is required to complete a self-assessment questionnaire that covers some of the basic technical and procedural controls that are needed to be in place.
• External Vulnerability Scan – The vulnerability scans offer a deeper level of assurance by scanning the network perimeter of all internet connected locations for infrastructure and web application vulnerabilities, including dedicated hosting platforms.
• Internal Workstation and Mobile Device Security Audit – This stage assesses a sample of workstations for configuration and patching related vulnerabilities. A CREST qualified consultant will conduct a full build review against your standard workstation builds and mobile devices. Common malware will be delivered via emails and web browsing to assess perimeter protections using email (phishing) and web browsing (drive-by) threats to assess the effectiveness. This element is typically delivered onsite.

What Happens after a Cyber Essentials Assessment?

Once a vulnerability scan and self-assessment questionnaire have been completed, the organisation will be validated against the first stage of the Cyber Essentials scheme. Whilst there is no official expiration, LRQA Nettitude recommend this exercise is repeated at least annually.
When an organisational successfully passes a Cyber Essentials Assessment, LRQA Nettitude will issue a Cyber Essentials Certificate. LRQA Nettitude is also able to offer pragmatic advice and guidance on how any identified gaps or security weaknesses can be addressed.

Cyber Essentials Pre-assessments

When LRQA Nettitude initially engage with organisations, the team undertake a gap analysis to measure the organisations existing controls against what is required by Cyber Essentials. Having conducted this assessment, LRQA Nettitude then provide the organisation with a clear road map on how to bridge the gaps and reduce their risks associated with a cyber breach. As the organisation moves towards entry level certification, LRQA Nettitude can provide on-going guidance and assistance to ensure all elements of the assessment are being catered for.

Frequently Asked Questions about Data Privacy Security

What is an incident response policy?

An Incident response plan or policy is a process you create before you experience a cyberattack. This is so that your team has a procedure to follow when you do experience a data breach. LRQA Nettitude follows the CREST Cybersecurity Incident Response process which is broken down into 3 phases: preparation, response, and follow up. Having a breach plan gives you the confidence to quickly nullify any threat to your data privacy security.

Why is data privacy security important?

Although it has always been important, the implications and need for higher security are coming into play now that technology is indispensable to everyday life. Using apps, browsing websites, and shopping online are all examples of how your data will be stored and managed online. For organisations today, the threat of cyber theft is a pertinent one. Having comprehensive data privacy plans in place can reduce and mitigate the risks of such events.

Does LRQA Nettitude practice sustainability?

As a company with a global footprint, sustainability is an area of importance to us. We are a registered ‘Investor in People’ organisation. Taking a cue from ISO 14001, we have strong sustainability practices put in place. Our organisation also hires fairly and equally, across gender and race. By working with us, you can rest assured that we implement data privacy security measures with ethics at the core of our mission.

Get in touch via the form below and get a free quote from us for our Red Team Security Testing services.

General Enquiry