Cyber Essentials Certification

Cyber Essentials is a government-backed cyber security certification designed to show that your business is working to a recognised security standard and has measures in place to protect against the most common cyber threats. It can give your customers, suppliers and anyone you work with additional peace of mind that you take cyber security seriously. Central IT can help you through the process and advise on any changes required to help you achieve certification.

Most businesses can benefit from Cyber Essentials. It isn’t a legal requirement for every organisation, but it demonstrates that you are working to a recognised cyber security standard and can give customers and suppliers additional confidence in your business. It is also required for some contracts and supply chains, including a number of government contracts.

Timescales can vary depending on the current state of your IT systems and whether any changes are required. If everything is already close to the required standard, the process can often be completed within a few weeks. If hardware, software or security settings need updating first, it may take a little longer.

Yes. We can manage the process from beginning to end, reviewing your systems, identifying anything that needs changing and helping prepare the information required for the assessment. We aim to keep the amount of input required from you to a minimum, although the organisation applying for certification remains responsible for its assessment and a senior representative must ultimately confirm the answers provided.

We’ll advise you on what changes need to be made in order to comply. This is all part of the service when we help you work towards Cyber Essentials certification. Where changes are required, we can help implement them and get your systems into a position where they meet the required standard.

In a word, yes – any devices and software that fall within the scope of the certification need to meet the Cyber Essentials requirements. This includes using licensed and supported software and keeping security updates applied. Again, we can advise on anything that needs upgrading or replacing and help bring your systems up to the required standard.

Yes. Microsoft 365 is considered a cloud service and can fall within the scope of Cyber Essentials. The current requirements specifically state that cloud services cannot simply be excluded from scope, and Microsoft 365 is listed as an example of an organisational cloud service. Security measures such as multi-factor authentication, appropriate user access and secure account configuration are therefore an important part of meeting the requirements.

Both Cyber Essentials and Cyber Essentials Plus are based on the same five technical controls. Standard Cyber Essentials involves a verified self-assessment, whereas Cyber Essentials Plus includes an additional independent technical audit and testing of your systems to confirm that those controls are actually working in practice. Cyber Essentials Plus therefore provides a higher level of assurance.