How to Prepare for Cyber Essentials Assessment

6 Steps to Prepare for a Cyber Essentials Assessment

To achieve Cyber Essentials certification, you must demonstrate that your organisation has implemented the necessary security measures. The following six steps will help you prepare for the Cyber Essentials assessment and ensure that your organisation meets the required standards.

Step 1: Understand the Requirements

The first step in preparing for a Cyber Essentials assessment is thoroughly understanding the scheme’s requirements. The five core controls outlined by Cyber Essentials form the backbone of the certification process.

These controls are:

• Firewalls and Internet Gateways: Firewalls protect your systems from external threats by monitoring incoming and outgoing network traffic.
• Secure Configuration: Devices and software must be configured securely, ensuring that unnecessary features and accounts are disabled.
• Access Control: Only authorised individuals should have access to your systems, with multi-factor authentication (MFA) and strong password policies in place.
• Malware Protection: Anti-malware software must be installed and regularly updated to detect and prevent malicious software.
• Patch Management: Regularly updating software with the latest security patches is essential to close vulnerabilities.

Familiarise yourself with each control and understand how they apply to your organisation. This is especially important if you’re deciding between Cyber Essentials and Cyber Essentials Plus, which involves additional technical testing.

Step 2: Conduct a Gap Analysis

Once you understand the Cyber Essentials requirements, the next step is to perform a gap analysis to assess your current security posture. A gap analysis will help you identify areas where your organization already complies with the Cyber Essentials standards and where improvements are needed.

Key areas to assess during the gap analysis include:

• Firewall configurations and network security measures.
• Secure configuration practices for all devices and software.
• User access controls and password policies.
• Anti-malware software and its update frequency.
• Software patching processes for operating systems and applications.

Document your findings to create a clear action plan that addresses any gaps and ensures all required controls are implemented before the assessment.

Step 3: Implement Required Controls

Based on the results of your gap analysis, the next step is to implement the necessary security controls to meet the Cyber Essentials requirements.

• Firewalls: Ensure that all devices are protected by properly configured firewalls to prevent unauthorized access. Restrict access to external networks, and regularly review firewall rules to ensure they are up to date.
• Secure Configuration: Review device and software configurations to remove or disable any unnecessary accounts, services, or features that may present vulnerabilities. Apply baseline configurations to ensure consistency across devices.
• Access Control: Implement user access controls based on roles and responsibilities. Use multi-factor authentication (MFA) wherever possible and enforce strong password policies. Regularly review access rights to ensure they are appropriate.
• Malware Protection: Ensure that anti-malware software is installed and updated regularly. Restrict the download of software from untrusted sources and consider disabling macros from unknown documents to prevent malware execution.
• Patch Management: Establish a patch management process that ensures all systems and software are updated with the latest security patches. Use automated tools to deploy patches efficiently and prioritize critical updates.

By implementing these controls, you can significantly reduce your organisation’s exposure to cyber threats and ensure compliance with Cyber Essentials.

Step 4: Document Policies and Procedures

Once the necessary controls are in place, it’s essential to document your policies and procedures related to each security control. Comprehensive documentation not only provides a clear reference for ongoing maintenance but is also required during the assessment to demonstrate compliance.

Key documentation should include:

• Firewall configuration details and rules.
• Device and software secure configuration policies.
• User access management and MFA policies.
• Anti-malware software management and update schedules.
• Patch management procedures, including update frequency and responsibilities.

Ensure that your documentation is clear, up to date, and easily accessible to relevant teams. This will streamline the assessment process and provide evidence that your organisation follows best practices in cybersecurity.

Step 5: Conduct Employee Training and Awareness

Employees play a vital role in your organisation’s cybersecurity, and their awareness of potential threats and best practices is crucial. Training and awareness programs ensure that your staff understands the importance of cybersecurity and how they can contribute to maintaining a secure environment.

Key training topics should include:

• Recognising phishing attempts and how to report suspicious emails.
• Best practices for secure internet browsing and email usage.
• The importance of strong passwords and multi-factor authentication.
• Safe usage of external devices like USBs and external hard drives.

Regular cybersecurity training sessions, along with ongoing awareness campaigns, will reinforce the importance of cybersecurity across your organisation and minimise human-related risks.

Step 6: Complete the Self-Assessment Questionnaire

The final step in the Cyber Essentials certification process is to complete the self-assessment questionnaire. This questionnaire covers the five key controls and asks for detailed information on how your organisation has implemented each one.

When completing the questionnaire, ensure that all responses are accurate and supported by documented evidence, such as firewall configurations, security policies, and patch management logs. The questionnaire must be reviewed and approved by a senior executive or IT manager before submission to an accredited certification body.

For Cyber Essentials Plus, prepare for an additional technical assessment, where an independent assessor will verify the effectiveness of your controls by testing your systems.