What is Cyber Essentials and why does it matter?

Organisations should start taking active steps towards cybersecurity. Many SMEs believe they will not be the target of cyber-crime as they have nothing worth stealing. However, cyber attackers are cunning and recognise that data has value internally as well as externally. Locking companies out of their own data and preventing them from operating can be just as damaging as leaking that data. A recent cyber white paper from Trowers & Hamlins noted around 60% of SMEs who were victims of cyber-attacks did not recover and closed within six months.

Over the past 12 months, 39% of organisations across the UK have reported having suffered a cyber security breach or attack. This number is also believed to be understated due to organisations not having the ability to successfully identify an attack when it happens.

Cyber Essentials (CE) is a government backed scheme developed to provide an organisation with the core fundamentals required to defend against approximately 80% of common cyber-attacks. It demonstrates commitment to an organisation’s customer base, showing how you are proactively protecting your data.

1. Who does this apply to?

Whilst CE is encouraged for all organisations, some government contracts advertised after 1 October 2014 require you to be CE accredited before going to tender. To become a supplier of a government department (those noted below), you are required to certify to CE if you intend on handling sensitive data (as defined in point 2 below).

• Non-Ministerial Departments
• Executive Agencies
• Non-Departmental Public Bodies including MoD.

2. Supplier characteristics:

Where suppliers intend to handle, store, or process any one of the following characteristics for a government department, they must certify to CE.

• Where personal information of citizens, such as home addresses, bank details, or payment information is handled by a supplier.
• Where personal information of Government employees, Ministers and Special Advisors such as payroll, travel booking or expenses information is handled by a supplier.
• Where ICT systems and services are supplied which are designed to store, or process, data at the OFFICIAL level of the Government Protective Marking scheme.

3. What if I am not involved in government contracts?

Cyber Essentials is relevant to all organisations. The certification not only evidences strong internal controls over your cyber security position but also, as mentioned previously, ensures the appropriate measures are in place to mitigate approximately 80% of common cyber-attacks.

Cyber criminals target businesses of all sizes, whether you are a small organisation with only three employees, or a larger organisation with thousands, you can be targeted. Cyber Essentials takes this into consideration and makes it achievable for all, regardless of the complexity or simplicity of your IT infrastructure.

After completing the Cyber Essentials certification, not only will you have assurance that you are following the recommended best practices, but you will also have a greater understanding of your devices, and any gaps that we may identify.

4. How do I certify to Cyber Essentials?

You will need to start by completing a CE self-assessment which can be performed with the support of an accredited certification body. Once a self-assessment has been completed, then a CE auditor will be able to assess your organisation and provide feedback for improvement and further alignment to the standard. Soon after, your certificate will be issued and will be valid for 12 months. The CE standard is annually updated and so supports organisations’ defences against new and upcoming threats.

5. How can we help?

PKF Francis Clark is an accredited certification body of the IASME Consortium and can support you from the beginning of your journey to the end. If you would like to know more about the certification or our cyber security services, please do not hesitate to reach out for a free of charge initial conversation with our cyber security Director, Phil Osgathorpe.

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/526200/ppn_update_cyber_essentials_0914.pdf

https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022 – section 5.1