Cyber Essentials is a UK government-backed certification scheme designed to help organizations implement basic cybersecurity measures and protect against common online threats. To achieve Cyber Essentials certification, organizations must meet the following requirements:
- Boundary Firewalls and Internet Gateways:
- Ensure that firewalls and internet gateways are in place to secure network connections from external threats.
- Configure firewalls to allow only authorized and necessary network traffic.
- Secure Configuration:
- Establish and maintain secure configurations for all devices used within the organization’s IT infrastructure.
- Apply appropriate security patches and updates in a timely manner.
- Remove or disable unnecessary software, services, and user accounts.
- User Access Control:
- Implement strong user access controls to restrict access to systems and data based on user roles and responsibilities.
- Use unique user accounts for individual users and enforce strong password policies.
- Malware Protection:
- Use malware protection software to defend against known malware and perform regular scans to detect and remove malicious software.
- Ensure that malware protection is kept up to date.
- Patch Management:
- Implement a process to regularly apply security patches and updates to all devices and software used within the organization.
- Maintain an inventory of software and hardware assets to track patch management.
Meeting the requirements of Cyber Essentials involves implementing these security measures and ensuring they are properly documented and adhered to within the organisation. Once the necessary controls are in place, organizations can undergo an assessment by a certified certification body to verify compliance and achieve Cyber Essentials certification.
It’s important to note that there are different levels of certification available, including Cyber Essentials and Cyber Essentials Plus. Cyber Essentials Plus involves additional verification through internal and external vulnerability scans and an on-site assessment. The requirements outlined above pertain to the basic Cyber Essentials certification.
