The Cyber Essentials UK checklist

The Cyber Essentials compliance framework was launched by the UK government in June 2014. In October of that year, Cyber Essentials became a requirement for any organisation that wants to bid on government contracts, a move designed to encourage adoption. 

Cyber Essentials is intended to help your organisation demonstrate its commitment to security. Investing in this comprehensive cybersecurity scheme enables your organisation to better protect its sensitive assets from online threats. With the proper controls in place, you can bolster your security postures to minimise cyber-related disruptions and maintain business continuity. 

This checklist is a resource to help organisations understand the requirements for Cyber Essentials certification, evaluate the effectiveness of their current safeguards, implement necessary controls, and maintain a robust long-term security posture.

‍

What is Cyber Essentials?

According to the Gov.UK website, “Cyber Essentials is a government-backed and industry-supported certification scheme which helps businesses protect themselves against cyber attacks. It provides a clear statement of the basic controls organisations should have in place to protect themselves against common cyber threats.”

Since its rollout in 2014, the Cyber Essentials scheme has broadened in scope, now including cloud services and requiring specific controls around authentication, passwords, and pins. 
‍
Cyber Essentials is a robust framework that helps organisations systematically safeguard their assets by implementing the appropriate and necessary controls, enabling them to stay ahead of increasingly sophisticated cyber threats with best practices and industry-standard controls. Cyber Essentials can be undertaken by your organisation without outside input, but to attain Cyber Essentials Plus accreditation, you must undergo a third-party audit. 

It’s worth noting that UK Cyber Essentials has several overlapping control evidence requirements with other standards (60% with ISO 27001) but applies more stringent criteria to many of their requirements. 

For example, unlike SOC 2 or ISO 27001, Cyber Essentials is prescriptive, enforcing best practices as hard requirements rather than allowing organisations to choose their own approach. Although it’s more limited in scope than ISO 27001, it provides practical threat management guidelines to harden your security and reduce the attack surface - more on how they compare here.

Beyond providing a push to secure your organisation’s infrastructure, including networks, systems, and sensitive data, attaining Cyber Essentials accreditation offers other long-term benefits:

• Increased stakeholder assurance and trust in an organisation’s security commitment 
• Enhanced visibility across networked infrastructure
• Ability to meet compliance requirements for UK-based organisations 
• Enables organisations to bid for UK government contracts

With this in mind, your organisation must approach the Cyber Essentials accreditation practically, minimise potential certification delays, and secure its systems continuously.

{{cyber-essentials-uk="/checklists"}}