Cyber Essentials Plus – what’s involved and how to achieve it as quickly and easily as possible

May 16, 2022

Lots of companies and organisations are being told they need to have a Cyber Essentials Plus certification and are wondering what that actually means and how on earth they should go about it.

In this video, we do our best to explain exactly what’s involved and how you can get the Cyber Essentials Plus certification as quickly and easily as possible…

 

 

First a quick sense check: Cyber Essentials Plus shouldn’t be a big deal. It’s not complicated or tricky and if you have your IT set up well, or have decent IT support, you shouldn’t have any problems getting through – we help hundreds of companies through it and most find it straightforward

So what is Cyber Essentials Plus

Cyber Essentials Plus (or Cyber Essentials Level 2) is the ‘credible’ big brother of Cyber Essentials (or Cyber Essentials Level 1) because it requires independent verification of the controls you have in place.

Cyber Essentials is the Government & NCSC-backed entry level accreditation, which is recommended by ICO as part of Data Protection/GDPR security. It helps protect against 80% of online threats, and it is increasingly required as part of supply chain due diligence. Cyber Essentials Plus is Cyber Essentials with independent technical audit of your systems.

Successful accreditation results in a certificate and badge (marketing opportunity).

What does it look at?

Cyber Essentials Plus looks at 5 areas of good practice:

  1. Patch management – have you applied the latest device and software patches? This ensures that devices and software are not vulnerable to known security issues for which fixes are available.
  2. Malware protection – do you have anti-malware on your devices? This will restrict execution of known malware and untrusted software and help prevent harmful code from causing damage or accessing sensitive data.
  3. Access control – have you ensured only the people who need access to important data have it? By ensuring that only authorised individuals have user accounts, and that they are granted only as much access as they need to perform their role, you reduce the risk of information being stolen or damaged.
  4. Secure configuration – have you set up your devices securely to help reduce the level of inherent vulnerabilities and protection from common cyber-attacks?
  5. Boundary firewalls and internet gateways – have you configured your firewalls correctly with restrictions, so only necessary services can be accessed from the internet?

How do you get Cyber Essentials Plus?

Achieving Cyber Essentials Plus is a two-stage process: 

You first have to achieve the basic Cyber Essentials (Level 1) accreditation. This is a self-assessment questionnaire, completed online through a dedicated portal. Then you have 90 days to obtain Cyber Essentials Plus (Level 2), (this includes the independent verification from Securious or another Certification body).

How much does it cost?

There are two types of cost:

The certification costs for Cyber Essentials (Levels 1 and 2). These vary on your company size, but will be between £500 to £1,000

Then you need an independent assessment by a qualified Cyber Essentials Certification Body (like Securious). That cost depends on the company you work with and your size, but at Securious it will normally cost between £500 and £2,000

These prices do not include your own IT costs to ensure your systems are in shape if such work is needed.

Final thoughts

  • Cyber Essentials should not be a big deal or anything to worry about
  • It looks at 5 areas you should be covering as good practice
  • It’s an increasingly valuable qualification and a great first step
  • The process can take a few weeks or months depending on your organisation
  • We suggest you get started as soon as you can!

 

If you have any questions or would like to know more, contact us on info@securious.co.uk, fill in this form, or read more on our Cyber Essentials Page…