Cyber Essentials
Consultancy

Cyber Essentials FAQs

• What is Cyber Essentials?

  Cyber Essentials is a Government-backed scheme, designed to help businesses of any size to implement a simple yet effective security framework.

  By becoming Cyber Essentials certified, you can protect your business against the vast majority of cyber attacks.

• Why was Cyber Essentials introduced by the UK Government?

  IASME Cyber Essentials was launched back in 2014 by the Government in recognition that there wasn't a compliance out there fitted for small businesses. ISO 27,001 was the only industrial, security industry standard available and it was very complicated and not really suited to small businesses. So in that space, Cyber Essentials was launched.

• What are the Cyber Essentials certification requirements?

  IASME Cyber Essentials has five controls which is designed for the small businesses:

  1. Malware protection
  2. Firewall control
  3. Access control
  4. Secure build
  5. Access management

  Amazingly, they can mitigate against 80% of the cyberattacks at the moment. I am a big believer in MED, minimal effective dose, and these very five basic controls can really protect small businesses against cyber attacks.

• Why do small businesses choose Cyber Essentials?

  There's really two reasons why business choose to become certified through IASME Cyber Essentials:

  1. To show their willingness to protect their business and ultimately their customers and their supplier's data against cyber attacks.
     
     
  2. We are also seeing businesses being forced by the supply chain to have these compliance measures in place. It is regulatory. Clients approach us because their contract stipulates that they must have Cyber Essentials. The reason for this is because there is an ongoing, big issue with supply chain threats where cybercriminals and cyber hackers will try and infiltrate the supply chain. The bigger companies are being targeted through the smaller businesses. They are using the small businesses as a weak chain in the link to attack the larger organisations.

• How is Cyber Essentials assessed?

  IASME Cyber Essentials is, at its very basic form, a self-assessment. The assessment is done online through the IASME website. IASME are a Government partner, chosen by the National Cyber Security Centre to lead the certification.

• What's the cost of Cyber Essentials?

  The cost of the Cyber Essentials assessment is from £300 +VAT. The cost of the assessment has increased since January 2022, with a new tiered pricing structure based upon the number of employees:

  Micro organisations (0-9 employees) £300 + VAT
  Micro organisations (0-9 employees) £400 + VAT
  Medium organisations (50-249 employees) £450 + VAT
  Large organisations (250+ employees) £500 + VAT

   

  This does not include the cost of the security defences that you need to pass the certification, such as firewall controls and malware protection. You may also need to take into consideration the time you need to create new documentation, implement policies or undergo ongoing audits.

  Many businesses work alongside a security partner to ensure they are compliant and pass first time. There are a variety of service levels you can choose from. Some services simply complete the self-assessment on your behalf, which can cost in the region of £300-500 (not including the cost of the assessment). Other providers offer a more in-depth service. IT and security companies, such as Superfast IT, help small businesses through Cyber Essentials consultancy. We, for example, offer a fully managed service for a fixed fee of £100 per month, which would include the cost of the assessment.

  As a part of the cost, we perform an initial gap analysis and ensure that all required security controls are properly configured before submitting the self-assessment. That way you can be safe in the knowledge that your security is installed, maintained and regularly updated with the all important security patches. We also complete ongoing security audits, as the certification stipulates. 

  Find out more about our Cyber Essentials consultancy service or speak to one of our experts to find out more.

• Why become Cyber Essentials certified?

  1. Protected

  Protected against a wide variety of the most common cyber-attacks and 80% of IT security breaches.

  2. Pass supply chain requirements

  Meet central government, defence sector and larger clients' supply chain requirements that stipulate for suppliers to pass Cyber Essentials.

  3. GDPR compliance

  Fulfil your legal responsibilities. Recognised by the Information Commissioners Office as good practice and can mitigate penalties should an organisation suffer a breach. Cyber Essentials is evidence that you have taken the first steps to becoming GDPR compliant. 

  4. Impress clients

  Having the certification demonstrates that you serious about securing your prospect client's data. Demonstrating your business' professionalism and helping you to stand out from the crowd.

  5. Peace of mind

  Your security is managed and in your control. Be confident that you have an appropriate level of security.

  6. Reduce the likelihood of being targeted

  Cybercriminals seek targets that do not have Cyber Essentials technical controls in place. If you are failing to stop simple attacks, the more likely you are to be targeted.