What You Need to Know About Cyber Essentials 2023 Update

What to expect in 2023?

It’s been a whole year since 2022’s Evendine update, which was one of their biggest changes to Cyber Essentials we’ve ever seen, and included many new questions, advisory questions, and generally upset the applecart. This year however, things have taken a slightly different approach. Whilst Montpellier does also include new questions, the focus for 2023 is a re-organisation on where and how the questions are asked – quality of life changes, in other words. This is gratefully received by assessors like me and businesses alike.

Summary of 2023’s changes

Here are the key dates you need to know about and how they may affect you on your journey to achieving Cyber Essentials certification.

1. Informational questions are now gone. These are now marked against compliance, so having your previous reports may come in handy to cover comparisons.
2. There’s new definitions to BYOD devices and what should be considered in scope for the organisations controls.
3. Multiple reasons for the certification are now an option in case you need more than one reason to certify.
4. Remote workers of all sizes are now included and have been moved to scoping to assist with the appropriate network layout questions.
5. More selectable options for the password configuration questions.
6. No more sandboxing on section eight, so you either have anti-malware or you have applications predefined and installed from vetted sources.
7. The new requirement document (3.1) has a much better layout and easier for the applicant to understand, with what controls are being referred on each of the assessment sections.

Looking at the changes in detail

Let’s look at those in more detail.

1. Informational questions

Under Evendine there were a few additional, optionable, and special questions that were just for information only. If you were the one responsible for Cyber Essentials compliance in your company you’ll remember the ones I’m talking about. Sadly, a lot people quickly skipped these to hastily get to the next section. The questions included “What thin clients are in scope?”, “What process is used for the unsupported software and how their segregation is achieved?”, and of course the big question, “Do all users that use the cloud services in scope have MFA enabled?”.

These existed almost solely to give the applicants a heads up and to make them aware of the future questions, so that they can plan for their future assessments. So if you paid attention to those optional questions last time you’ll have a much easier ride achieving certification in 2023. Now they’re marked against compliance, you’ll need to answer these questions honestly. Of course, this is the point where I highlight Bulletproof’s Cyber Essentials services, where you can get support from friendly, experienced assessors like me to help you through the whole process.

2. BYOD scope changes

Montpellier’s changes go a long way to giving a better understanding of what’s in-scope (and what’s not) for BYOD devices. For example, there’s a brand new table of what third-party devices should be in scope, making is slightly easier to establish the asset management means within the organisation. So, if a consultant that works contractually for you has their own device, you no longer need to stress over about finding all the details of what the device is and what the OS build may be.

3. Reason for certification

The benefits to getting Cyber Essentials certification are, I think, fairly well known by this point. CE certification enables new business (especially Cyber Essentials Plus) and actually delivers a good security baseline. Previously a lot of the companies I’d helped with compliance found it hard to pick one reason to put on the form as to why they were undergoing certification. Of all the things to spend time on, this is something that should be an easy, no-brainer fill. Not just for the company undergoing certification either – ISAME and the NCSC collect this information understand the drivers for Cyber Essentials certification so they can feed that back into keeping the standard relevant and up to date. Now in 2023’s Montpellier, businesses undergoing certification can enter two reasons. Just a nice quality-of-life change that adds up to this being a much ‘friendlier’ edition than 2022’s version.

4. Remote working

The remote workers question, previously in the first section of the assessment questionnaire, has been moved to section two, where it sits nicely in with the scoping requirements. This makes it easier to see how the organisation is laid out and how the controls can be applied to remote workers. This question also no longer asks you to just list the people that are legally required to work remotely, but all those who work hybrid, so anyone who remote works for any reason should now get to be included. No-one is left behind. One plus side to this is that now that the question is closely linked to the network question, so it’s far less likely for the home networks to be an oversight.

5. More options on password complexity

A few of the multiple-choice questions relating to the methods and password complexities, now include, you’ve guessed it, another multiple-choice option. In this instance, it’s “D” which is “None of the Above”. Again, a neat quality-of-life change that works to simplify the whole process.

6. No more app sandboxing

Speaking of multiple choices, A8.6 application sandboxing is being removed as an option for the anti-malware section. To cut a long story short, there was some debate (and a lack of consensus) on what a true ‘sandbox environment’ should actually be, and how it could be a sufficient means for this control. So, the option was removed altogether.

7. New requirement document

To go along with the changes to the scope, the controls and the new structure, the layout of the assessment document itself has also improved. All changes in 2023’s Montpellier question set of Cyber Essentials has been done with practicality in mind. It’s been made easier for businesses undergoing CE certification to manage their organisational resources, the technology available to them and mitigate the threats they’re facing.

In summary

All in all, the changes to Cyber Essentials in 2023 are designed to help businesses keep their organisations secure from the most common internet-based vulnerabilities, determine areas of opportunities and establish what technical controls need greater focus. Ultimately, this years’ changes keep your business more secure. Bottom-line, that’s what it’s all about.