Cyber Essentials is one of those things most businesses have heard of, but aren't always completely sure what it means. Is it a piece of software? Another cyber security standard? Something you have to have? And does getting the certificate actually make your business any safer?
In simple terms, Cyber Essentials is a UK government backed scheme designed to help businesses protect themselves against some of the most common cyber attacks. It isn't about turning your business into Fort Knox. It's about making sure some sensible security basics are properly in place.
The National Cyber Security Centre has plenty of information about the scheme if you want to delve into the detail, but here's our simpler version.
Cyber Essentials focuses on five areas of your IT security :
👉 Firewalls
👉 Secure configuration
👉 Security update management
👉 User access control
👉 Malware protection
None of those sound particularly exciting, but that's rather the point. A lot of cyber security is about getting the basics right.
When you start looking properly, you may discover laptops that aren't receiving updates, people with administrator access they don't actually need or old software that nobody realised was still installed. The NCSC Cyber Essentials requirements explain exactly what's expected.
It's also a useful exercise even if certification isn't your immediate goal.
Not every UK business is required to have it, but increasingly you may find customers, suppliers and tender processes asking whether you're certified. It can also be required for certain government contracts.
Even when nobody is asking for the certificate, though, Cyber Essentials gives you a useful framework for reviewing your security. Rather than asking the enormous question, “Are we secure?”, you're looking at specific things that can actually be checked and fixed.
If you're curious about how prepared you are, the official Cyber Essentials Readiness Tool is a useful place to start.
Hopefully! But antivirus is only one part of the picture.
Modern security is much more about layers. At Espi, for example, our Endpoint Detection and Response service goes further than traditional antivirus by monitoring devices for suspicious behaviour.
You also need to think about updates. The NCSC recommends keeping devices and software up to date, because updates frequently fix known security vulnerabilities.
This is where Remote Monitoring and Management can help too. Rather than hoping everybody remembers to look after their own laptop, devices can be monitored and managed centrally.
Account security is another important part of the conversation. If somebody gets hold of a genuine username and password, they may not need to install anything malicious at all. They can simply try to log in.
The NCSC guidance on protecting online accounts explains why additional authentication is so important. Microsoft also provides guidance on multi factor authentication for Microsoft 365 and other Microsoft services.
And if phishing is one of your concerns, the NCSC has some very useful guidance on spotting phishing scams.
No, and we'd be suspicious of anybody who told you otherwise!
Cyber Essentials is about protecting your business against common attacks. It gives you good foundations, but there are still other things to consider, including email security, backups, Microsoft 365 protection, monitoring and staff awareness.
The NCSC's small business cyber security guidance is a useful resource for looking at the wider picture.
That's also why our Espi Cyber Security approach looks at your overall protection rather than simply ticking a box for one particular product or certificate.
You don't need to work it all out before talking to us. In fact, we'd rather you didn't spend hours trying to decipher security terminology if we can help!
If you're considering Cyber Essentials, or you're simply wondering whether your current IT security covers the basics properly, talk to the Espi team. We can look at what you already have, identify any gaps and explain what needs attention in normal English.
You may find you're much closer than you thought 😊
📧 support@espi.net
📞 01954 213999
