Deciphering Cyber Essentials | Choosing Between Essentials and Plus Certifications

With increasing prevalence and sophistication of cyber attacks, it is more important than ever for businesses to safeguard their operations. Without adequate security measures in place, businesses risk financial losses, reputational damage, and legal issues. An effective way to mitigate these risks is through Cyber Essentials, a UK Government backed scheme designed to help organisations protect themselves against common cyber threats and demonstrate their commitment to cyber security.

From securing your network against malicious actors to ensuring the integrity of your data, Cyber Essentials serves as a baseline for robust cyber security.

Understanding Cyber Essentials and Cyber Essentials Plus

There are two levels of certification: Cyber Essentials and Cyber Essentials Plus. While both certifications are designed to strengthen cyber security, they differ in scope.

Cyber Essentials involves a self-assessment procedure, where businesses complete a questionnaire covering five essential technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. To become certified, a business’s self-assessment must show that they have these key technical controls in place and that they prevent breaches effectively. Before the self-assessment is submitted, a senior authority figure, such as a board member or business owner, must review the responses and declare that they are accurate. This self-assessment is then reviewed by an external IASME accredited Cyber Essentials Certification body.

The Cyber Essentials Plus certification is slightly more comprehensive. To obtain Cyber Essentials Plus, businesses must complete the Cyber Essentials self-assessment, but an external technical audit is also carried out. This involves an external party conducting penetration testing to verify that the business’s systems can respond effectively. While Cyber Essentials Plus requires additional investment in time and resources, it offers a higher level of assurance and is often required when bidding for contracts with larger enterprises and government agencies.

Choosing the right certification for your business

So, which certification is right for your business?

The answer depends on various factors, including your industry, risk tolerance, and regulatory requirements. Whether you opt for Cyber Essentials or Cyber Essentials Plus, the importance of certification cannot be overstated.

Cyber Essentials is particularly suitable for businesses looking to establish fundamental cyber security practices. It is ideal for smaller businesses looking to strengthen their security posture without extensive resource commitments. On the other hand, Cyber Essentials Plus involves a more rigorous assessment, making it a better fit for businesses that require a higher level of assurance about their cyber security practices.

In today’s security landscape, Cyber Essentials accreditation is considered a must-have for businesses that handle any sensitive data, such as those in the following sectors:

• Healthcare
• Education
• Not-for-profits
• Financial services
• Professional services
• Retail and e-commerce
• Technology

Businesses seeking an additional level of assurance that their data and systems are protected may also wish to become Cyber Essentials Plus accredited.