How to Get your Cyber Essentials Certification: A Process Guide

Originally published Vanta.

Most organizations today are heavily reliant on technology, regardless of the product or service they provide. This expands their data exposure points and potential attack surface, which is why there is a significant need to monitor the risks and vulnerabilities in the cybersecurity landscape.

Cyber Essentials certification is a comprehensive cybersecurity strategy involving vigilance over various scattered technologies, policies, and controls. It offers a systematic approach to oversight, encompassing all necessary practices to safeguard your systems and improve your organization’s security posture.‍

In this guide, you’ll learn all about different certification logistics and get an easy-to-follow six-step process for getting accredited faster.

‍

What is Cyber Essentials?

Cyber Essentials is a security accreditation program (also called scheme) that helps organizations of all sizes and industries implement the necessary technical and administrative controls to protect their networks and systems.

The framework was launched by the National Cyber Security Centre (NCSC) in 2014 and is backed by the U.K. government. However, organizations outside the U.K. can also get certified by reaching out to a relevant certification body.

‍

What are the benefits of a Cyber Essentials accreditation?

Obtaining a Cyber Essentials certificate comes with various strategic and long-term benefits, such as:

• Access to lucrative government contracts (for UK-based organizations).
• Robust protection against various attacks through industry-standard security measures.
• Stakeholder assurance and trust as a result of demonstrated security.
• Complete visibility into an organization’s tech stack and security landscape.

What makes Cyber Essentials appealing to many organizations is that it’s a self-assessment certification, which adds to the convenience factor. You don’t have to deal with many external parties to achieve accreditation—unless you’re pursuing Cyber Essentials Plus.

Cyber Essentials Plus offers a more advanced assurance that involves a third-party audit on top of the self-assessment questionnaire required for base-level Cyber Essentials certification. Applying for Cyber Essentials Plus can also be more expensive.

6 easy steps to obtaining a Cyber Essentials certificate

Whether you're pursuing Cyber Essentials or Cyber Essentials Plus certification, you should complete the following basic steps:

1. Define your Cyber Essentials requirements.
2. Conduct a gap analysis.
3. Implement the identified controls.
4. Set up monitoring of networks and devices.
5. Train relevant team members.
6. Complete a self-assessment.‍

We’ll expand on each step below to help you prepare internally for certification.

‍

Step 1: Define your Cyber Essentials requirements

Your Cyber Essentials certification scope should ideally encompass your entire IT infrastructure. The goal is to get comprehensive protection for your systems, networks, and devices and prepare them to address identified vulnerabilities.

Still, ensuring such a broad scope isn’t always possible. For example, you might be using outdated software or processes that aren't covered by Cyber Essentials and can’t be protected by the framework. Another common scenario is the implementation of isolated guest networks that don’t have access to a wider system and data—they can be excluded from the scope.

After defining the certification scope, you should familiarize yourself with the Cyber Essentials requirements across five critical technical controls:

The NCSC offers various resources you can consult to understand your specific obligations.

‍

Step 2: Conduct a gap analysis

Examine your infrastructure’s current standing to conduct a robust gap analysis and determine how far you are from meeting the necessary Cyber Essentials requirements.

This process may take some time, but it’s crucial to be thorough because the analysis will inform all the following certification steps.

For example, Cyber Essentials requires all your servers to be listed in an asset register. Upon examination, you might notice that your register doesn’t contain virtual servers, which should've been included. You can then request the relevant team member to include the data in the register so the organization can pass the corresponding control.

All such gaps and corresponding action items should be documented for clarity. You may even want to create a checklist to streamline the process.

‍

Step 3: Implement the identified controls

After creating an action plan/checklist, you should take steps to execute it according to priority. For example, if you prioritize secure configuration controls, you can complete the following activities.‍

• Disable/delete unnecessary accounts.
• Change all default and easy-to-guess passwords.
• Secure channels to prevent brute-force attacks.
• Deploy anti-malware solutions.
• Use multifactor authentication to secure user access.

This step will likely require you to collaborate with all relevant departments, such as your procurement, legal, or HR teams. If other department heads need to make certain updates, it’s best to document the task owners and keep communication channels open to support implementation.

‍

Step 4: Set up monitoring of networks and devices

After implementing all applicable controls, you’ll need to verify their effectiveness by monitoring your networks and devices. Doing so is essential for proactively resolving any issues before initiating the certification process.

The best practice is to record the critical information you’re monitoring in a report, detailing items like:

• Control application and maintenance
• Configurations of networks, devices, and other relevant infrastructure components
• Access control policies and review results
• Software update and security patch frequency
• Malware protection measures

The report should ideally be presented to a senior executive of your organization to verify that you’ve implemented the controls

Keeping track of all this data can be a significant challenge if you do it manually. A better alternative is to implement a software solution that uses automation to give you real-time updates on the status of your controls.

Step 5: Train relevant team members

IT employees and teams directly participating in the certification process should read all Cyber Essentials documentation. You can also expand the training scope to include key team members from all departments who must contribute to the certification processes.

The aim is to build a culture of security awareness that ensures you not only obtain a Cyber Essentials certificate but also effectively safeguard your organization in the long run.

Some of the key security aspects to cover in your training include:

• Account and password management: Teach employees to only log into accounts on safe devices and networks. Develop and communicate a password policy that helps employees create strong passwords and secure them effectively.
• Social engineering attacks: Cyberattacks like phishing are quite elaborate and sometimes hard to detect, which makes them more dangerous than other attack types. Teach your team to spot signs of phishing and develop a clear procedure for reporting a phishing attempt.
• Data sharing practices: Make sure your team members know how to securely share sensitive information online or offline. This is especially important for remote workers, who need to be mindful of device and network security.

‍

Step 6: Complete a self-assessment

When you’re ready, you can complete an online self-assessment questionnaire and have it validated by a senior team member to get your Cyber Essentials certificate. Answer truthfully and accurately to ensure your cybersecurity posture fully meets the necessary standards for obtaining the certificate.

Before you appear for the actual test, you can download free questions from the IASME Cyber Essentials Readiness Tool. It offers sample questions that help you assess the state of your current controls.

After obtaining it, you can either pursue Cyber Essentials Plus certification right away or in the following three months. Even if you decide not to go beyond the base-level certification, it’s worth taking steps to see that your organization adheres to the Cyber Essentials requirement at all times.