Cyber Essentials, Cyber Essentials Assisted or Cyber Essentials Plus?

Cyber Essentials and me

Since joining Securious over eighteen months ago, I have studied and completed training to become a qualified Cyber Essentials assessor, and have helped many clients achieve Cyber Essentials certifications.   

There are two parts of the process that I enjoy the most. The first one is the ‘light bulb moment’, when the client understands how vulnerable their configurations are.  Granted, this isn’t such a joy for the client – but it’s the first step towards improvement, and often the moment that an entirely new, pro-active approach is taken towards their cyber security.

The second is when clients receive their certification. It’s very rewarding knowing that opportunistic cyber attackers would likely not bother trying to break through the defences now in place, and instead go and find an easier target.    

Expectations v reality of the certification process 

We see a real mixed bag of expectations and experiences, which likely vary according to your motivations for gaining Cyber Essentials… 

You know you’re okay and want to prove it

Do you hold an impressive array of computing or networking qualifications? Maybe you have years of experience under your belt, and you’re intimately familiar with your networks and devices.  If you think you’re justifiably confident, you will hopefully fly through the question-answering phase with ease, requiring little – if any – help.   

You think you should be okay but aren’t totally sure

Sometimes, clients are optimistic and confident that their systems are secure – they may have a good password policy and run a respected antivirus application.  However, working through the Cyber Essentials questionnaire forces you to scrutinise some configurations and methods of working that you may not have realised are important.  This can be a light bulb moment – a great time to embrace this opportunity to learn and tighten–up your cyber security posture.

You need Cyber Essentials yesterday

An increasing number of businesses are looking to achieve Cyber Essentials in order to win or keep a contract that demands adherence to the Cyber Essentials (Plus) scheme.  But please don’t let yourself fall into a trap here – a certificate of compliance isn’t equal to security, and those that complete the Cyber Essentials questionnaire as a literal tick-box exercise, answering ‘yes’ to all the questions and providing answers that are geared towards getting marked ‘compliant’, but that are not necessarily based on true facts, can end badly.  Approaching the scheme with no genuine willingness to reach the Cyber Essentials standards is inviting a catastrophe. Instead, take the process seriously, make the changes it requires and find yourself protected from 80% of the most common forms of internet threat.

You’re not really sure where to start

It breaks my heart that anyone would feel embarrassed at having to admit a lack of computing knowledge! But the reality in business is that many of us have received no formal computing education, and some left school before IT and computing were included in the curriculum.  I don’t imagine that I could do these people’s jobs for a moment, and don’t rate them with any less kudos because their computing knowledge starts and ends with switching their devices on. It is entirely expected that some businesses require assistance with Cyber Essentials, and they tend to be a complete delight to work with, showing a genuine interest in learning how to configure their systems to maximum effect.  So if you aren’t sure where to start but are nervous of talking to someone who may try and sell at you, or confuse you even more, get in touch – whatever your level of knowledge, we can absolutely help you! 

Why we came up with Cyber Essentials Assisted? 

We can safely deduce that most clients require assistance to a lesser or greater degree, which is why Securious came up with the Cyber Essentials Assisted package.  It is designed to give clients the full support throughout the process, so that they don’t feel confused or overwhelmed by the questions.  We will organise a time, when braced with a large cup of coffee, we will screen share their questionnaire on the portal, and walk-through the questions together, one at a time.  A pre-submission check ensures that when clients are ready for certification, they will pass.  

What are the different levels / packages 

It is now a year since the Cyber Essentials questionnaire moved away from a Word Document to the Cyber Essentials Portal, and many of our clients, having been supported through the process once, feel confident enough with the portal and their systems to proceed with the self-assessment package.  For clients that are new to Cyber Essentials and the portal, I would recommend the assisted package without hesitation.  Get some support, avoid the pitfall of procrastination, and get the certification nailed! 

Achieving Cyber Essentials may meet your business requirements, but the ultimate certification is Cyber Essentials Plus.  This can be obtained after achieving Cyber Essentials and is where you hand the reins over to us to complete an audit of the controls that were declared as being in place on the portal questionnaire.  This certification holds a much higher level of kudos, as it provides validation that the secure controls declared in Cyber Essentials, are indeed in place.  We are seeing more and more frequently that contracts require adherence to Cyber Essentials Plus because of this verification.    

How to know which package you should go for 

Hopefully by now, you have a fair idea of which package suits you best, but just to make sure, if you answer ‘No’ to any of the questions below, you need Cyber Essentials Assisted!   

• Do you know where your boundary firewall is?  
• Has the default password been changed on your boundary firewall?   
• Would you know how to change it?  
• Are your users using standard user accounts for their day-to-day work?  
• Do you understand the difference between admin and standard user accounts? 
• Are your operating systems supported? 
• Are you sure??
• Do you know how to find out what operating system your devices are running? 
• Are all your software applications supported?   

Securious are more than a Certification Body.  We view each Cyber Essentials job as our opportunity to help our clients become more cyber aware and more cyber secure – and in all reality this is exactly what most of you need us to be. 

Learn more about our packages here