Apply for Cyber Essentials certification today

Both Cyber Essentials and Cyber Essentials Plus demonstrate that your organisation is taking cyber security seriously and has the five technical controls in place.

Cyber Essentials is an independently verified self-assessment questionnaire. If you have 2 or fewer major non-conformances, you pass.

Cyber Essentials Plus is the next step after Cyber Essentials. It can be thought of as an independent verification of everything that was claimed in Cyber Essentials. This extra level of scrutiny means your Cyber Essentials Plus badge will hold more weight with potential customers.

Whilst Cyber Essentials Plus is the more expensive of the two, it is held in higher regard and much of the work is done by the Certification Body. If you feel a bit overwhelmed and don’t know where to start, don’t worry – we have a range of packages to help you through the process.

The Cyber Essentials checklist takes the form of five technical controls which are easy to implement and designed to guard against cyber threats.

1. Firewall & routers

   To achieve Cyber Essentials or Cyber Essentials Plus you need to have a firewall. More than that, you need to be using it correctly. It needs to be applied across your entire network and protect every device in your IT estate, not just your desktops or laptops. Mobile devices should certainly have a correctly configured firewall in place as these could be regularly connecting to public Wi-Fi, which as you well know, can be murky territory.

   How your firewall is configured may depend on what activity you expect throughout the network on a normal day, so it is worth spending time to get this right. Of course, change all administrative passwords and block any unauthenticated inbound connections by default. That’ll be a good start.

2. Security configuration

   This one’s easy. Make sure all devices and software are configured to have the best security settings. Remove bloatware, change default passwords (don’t use Admin/Admin or P@ssword01 for that matter, as hackers sussed that ages ago). It’s also recommended that businesses start incorporating PINs or 2FA to increase security even further. If you really fancy it you can start using laser biometric scanners, but that’s up to you. Whilst these are by no means hacker proof (what is?), they do offer an extra layer of security.

3. Access control

   Whilst the main aim of all this is to stop a hacker getting in, you’ll also want to limit what they can do if they manage to slip past your defences.

   Making sure users only have access to what they need to fulfil their role is best practice. Cut down on the number of administrator accounts too. This will lower the risk of a high-privilege account getting compromised and allow you to easily keep track of who has access to what.

4. Malware protection

   Trojans, worms, ransomware, toads – you want to avoid these, even the one I made up. Malware is everywhere and is forever adapting. Hackers are tenacious and want to get into your network. They can work their way in using various methods. Up-to-date anti-virus software from reputable providers is, like most things in Cyber Essentials, a basic protection that there’s no reason not to do.

   Technical controls against malware are all very well and good, in fact they’re vital, but the best form of malware protection isn’t technical at all: it’s your staff. Specifically, it’s educating your staff. In order to dramatically increase your security posture, teach your staff to:

   • Spot the tell-tale signs of phishing,
   • Never open attachments or click links from unknown senders,
   • Steer clear of using USBs or other removable devices
   • Avoid dodgy websites.
5. Software updates

   To us technology enthusiasts this seems obvious, but your average user (and even some IT professionals) need the importance of this bringing home. Keeping software updated is an absolute must. Patches are usually released to fix a security vulnerabilities, so install them and install them regularly. Instruct your staff in no uncertain terms that, if their computers say ‘do not shut down’ until the updates are installed, that they definitely should not shut down. As we revealed in our 2019 annual report, out-of-date or unpatched software is one of the most frequently discovered flaws found by our penetration testers.

   An update schedule is vital for continuously plugging holes in your company’s security. This is often harder to do in smaller companies that may not have the dedicated resources to test and oversee these rollouts but, regardless of size, all companies should be doing so.

• Enhanced security – helps protect your organisation from the most common internet based cyber attacks such as phishing, malware, ransomware, password guessing and network attacks.
• Simple and cost effective – a simple process with a Cyber Essentials certification fee starting from £295.
• Gain and retain business – an increasing number of public, private and third sector contracts are mandating or actively encouraging Cyber Essentials from their suppliers.
• Aligns with GDPR – recognised by the Information Commissioner’s Office as a scheme that can provide security assurances that help protect personal data.
• Flexible scheme – regardless of sector or size, the scheme reviews basic, yet effective, technical controls an organisation in place. The scheme also recognises that not all organisations have a dedicated IT department, or an in-depth knowledge of cyber security.

Cyber Essentials self assessment cost starts from £295. In our experience however, most of our clients need expert support to navigate the complexities of the self assessment questionnaire therefore we offer additional support remote help for £595 & on-site support for £1,495.

At Bulletproof, the cost of Cyber Essentials Plus can be broken down as thus:

Yes, to complete Cyber Essentials Plus, companies must have gained the basic Cyber Essentials certification within the last 90 days.

If all your workstations are from a common build, we only need to undertake sample-based testing. However, if your organisation has multiple build types and you support BYOD (Bring Your Own Device), then each one will require testing individually.

Cyber Essentials focuses on fundamental IT controls, whereas ISO 27001 takes a more holistic approach, incorporating policies and procedures. As ISO 27001 is much more involved, you’ll find it easier to obtain Cyber Essentials/Cyber Essentials Plus certification if you’re already ISO 27001 compliant.

We recommend achieving Cyber Essentials in addition to ISO 27001 as it demonstrates your commitment to good security practices, and some business/customers may only look for your Cyber Essentials certification, or not understand the difference between Cyber Essentials and ISO 27001.