Cyber Essentials 101: Why Cyber Essentials December 3, 2024 – Posted in: Cyber Security, IT Support – Tags: Cyber Essentials 101, Cyber Security, cybersecurity, it support, ITServices, ITSupport, SmallBusiness
Cyber Essentials is a government-backed program that helps you protect your company from common cyberattacks. The IASME is the company that provides the certifications and assessments. For basic Cyber Essentials you will need to fill in a questionnaire, for Cyber Essentials Plus you will need to meet higher standards and an assessor will investigate your network directly.
Cyber Essentials is a great way to show your comers that you’re working to keep their data secure, and demonstrate your commitment to cyber security and data protection, which can help improve your reputation when you display the badge on your marketing material. It is required in order to bid for government contracts that involve sensitive or personal information and will allow you to be listed on the NCSC’s database of qualified companies.
The Cyber Essentials scheme can also help you audit your internal security and prepare for compliance with the General Data Protection Regulation (GDPR). Additionally many tender documents these days ask if you have and data security qualifications – Cyber Essentials ticks that box for you.
If your head office is in the UK and you have a turnover of less than £20 million you also get automatic, free of charge, cyber insurance if you achieve Cyber Essentials certification.
Section 1 – About Your Organisation
This section tells the assessors how your organisation is set up so they can mark your assessment appropriately. This section is best filled in by your admin team, with support from management.
A1.1 – What is your organisation’s name?
Why are they asking you this?
This is the name that will be displayed on your Cyber Essentials Certificate and has a character limit of 150.
What’s the detail?
Starting simply, for companies this will be what you are registered as with Companies House, for charities and organisations it will be what you are registered as with your relevant registration body.
If you are an organisation with subsidiary companies you can certify subsidiary companies on the same certificate.
The organisation can certify as a group and can include all the subsidiaries’ names on the certificate as long as the board member signing off the certificate has authority over all certified organisations.
Example answer:
The Stationary Group, incorporating The Paper Mill and The Pen House
or
The Paper Mill trading as The Pen House
A1.2 – What type of organisation are you?
Why are they asking you this?
This will make a difference to whether the insurance is available and has some impact on the answers expected for questions later on.
Example answer:
This is a multiple choice question, your options are:
- “LTD” – Limited Company (Ltd or PLC)
- “LLP” – Limited Liability Partnership (LLP)
- “CIC” – Community Interest Company (CIC)
- “COP” – Cooperative
- “MTL” – Other Registered Mutual (Community Benefit Society, Credit Union, Building Society, Friendly Society)
- “CHA” – Registered Charity
- “GOV” – Government Agency or Public Body
- “SOL” – Sole Trader
- “PRT” – Other Partnership
- “SOC” – Other Club/ Society
- “OTH” – Other Organisation
A1.3 – What is your organisation’s registration number?
Why are they asking you this?
To identify your company.
What’s the detail?
If you’re a UK limited company, your registration number will be provided by Companies House. Charities, partnerships and other organisations should provide their registration number if applicable. If you’re is applying for certification for more than one registered company, one registration number can be entered to represent the entire group.
A1.4 – What is your organisations address?
Why are they asking you this?
Again, to identify your business.
What’s the detail?
This is the legal registered address for your organisation.
A1.5 – What is your main business?
Why are they asking you this?
This is for demographic information and has some bearing on the expected answers to later questions.
Example answer:
This is another multiple choice, you’ll need to choose your industry sector from the list.
A1.6 – What is your website address?
Why are they asking you this?
To help identify your business and to allow the assessor to find your public presence.
What’s the detail?
Another simple one, just list your website address(es). If you do not have a website but do have a Facebook or LinkedIn page then your social media page should go here instead.
A1.7 – Is this application a renewal of an existing certification or is it the first time you have applied for certification?
Why are they asking you this?
It is important for the assessor to know whether this is your first time application or a renewal because Cyber Essentials is a journey. You will need to reach a minimum standard to receive your initial certification, but as you renew over the years you will be expected to have improved your security posture.
Example answer:
Another multiple choice, if you’ve previously achieved Cyber Essentials, select Renewal. If you haven’t previously achieved Cyber Essentials, select First Time Application.
A1.8 – What is your primary reason for applying for certification?
Why are they asking you this?
This helps the IASME continue to improve the certification and make sure it is fit for the purpose most people are using it for.
Example answer:
You’ll need to select from a multiple choice list, and provide clarification notes:
- Required for a commercial contract.
- Provide the name of the contracting organisation.
- Required for government contract.
- Provide the contract number and the contracting organisation.
- To give confidence to our customers.
- Required by insurer.
- Required by regulator.
- Provide details of the regulator.
- Required for a grant.
- Provide details of the grant issuing authority.
- To generally improve our security
- Other
- Specify your reason.
A1.8.1 – What is your secondary reason for applying for certification?
The reasons and requirements for explanation are the same as above – you just need to pick the second most important reason this time.
A1.9 – Have you read the ‘Cyber Essentials Requirements for IT Infrastructure’ document?
Why are they asking you this?
Reading this document first is important to help you fill in the questions.
What’s the detail?
This is a document that will help you understand what is required to pass the assessment. It can be found here: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf
Example answer:
We would strongly recommend reading it then answering yes to this question.
A1.10 – Can IASME and their expert partners contact you if you experience a cyber breach?
Why are they asking you this?
This is entirely up to you, the IASME are constantly seeking to improve the protection that being compliant with Cyber Essentials offers.
If you are breached they would like you to be willing to share data explaining why and how so they can review whether they need to change some of the requirements of the document. You’re under no obligation to agree though and can say no – it won’t affect your results.
Example answer:
Yes or no.
Next Week…
Next week we will cover the Scope of Assessment section of your Cyber Essentials.
Attaining a Cyber Essentials certificate is a great way to make sure you’ve covered the basics of protecting your data and your business. Often the most difficult elements are less around the technical areas – if hardware needs replacing, whilst it costs to do so, the process is fairly simple. The challenges are in user behaviour. This is where the most important thing about Cyber Essentials comes in. You need buy in. Your senior team need to be behind you all the way. Your staff need to understand why it is important and be committed to making it work.
If you’d like help reviewing what you’d need to do to be compliant, filling in the paperwork, or working with your staff to smooth any required changes, we can help. Give us a call on 01245 265 100 or email .