CYBER ESSENTIALS
Common Reasons Organisations Fail Cyber Essentials
Cyber Essentials isn't designed to catch organisations out. But seemingly small security gaps can cause problems.
Most Cyber Essentials requirements are based on sensible security practices.
The difficulty is often consistency.
An organisation might have excellent security across 95% of its environment while a handful of forgotten devices, accounts, applications or configurations create a compliance gap.
Understanding the common problem areas before beginning your assessment can save considerable time.
Common Failure Areas
The following are some of the most common gaps that can cause organisations problems during Cyber Essentials assessment.
1. Unsupported software
Old operating systems or applications that no longer receive security updates can create an immediate problem.
Fix: Identify unsupported software and upgrade, replace or remove it.
2. Security updates aren't applied quickly enough
A business may have a patching process but still fail to address qualifying vulnerabilities within the required timeframe.
Fix: Identify critical and high-risk vulnerabilities and ensure applicable security updates are deployed within 14 days.
3. MFA isn't properly enforced
MFA may be available but not required for every relevant user or cloud service.
Fix: Review cloud services, users, administrators and authentication policies and make sure MFA is appropriately enforced.
4. Excessive administrator privileges
Users sometimes have administrator access simply because it makes installing software or performing routine tasks easier.
This increases the potential impact of account compromise.
Fix: Restrict administrative privileges to users and activities that genuinely require them.
5. Forgotten user accounts
Accounts belonging to former employees, contractors or temporary users may remain active.
Fix: Regularly review accounts and promptly remove access that is no longer required.
6. Unnecessary software and services
Applications and services installed historically may remain active even though the organisation no longer uses them.
Every unnecessary component potentially increases the attack surface.
Fix: Remove or disable anything that doesn't have a genuine business requirement.
7. Firewall rules are too permissive
Old rules, unnecessary open ports or poorly controlled remote administration can leave systems unnecessarily exposed.
Fix: Review what is accessible from the internet and restrict access to genuine business requirements.
8. Incomplete asset visibility
This is arguably one of the most important.
An organisation can't reliably secure something it doesn't know exists.
Forgotten laptops, servers, virtual machines, cloud systems and applications can all create compliance gaps.
Fix: Maintain an accurate understanding of your technology environment.
9. Policy doesn't match reality
A security policy might state that updates are installed within 14 days. That doesn't necessarily mean they are.
Similarly, a policy might prohibit local administrators while dozens of users still have administrative privileges.
Cyber Essentials is about the controls you actually have, not simply the controls described in a document.
How to Reduce the Risk of Failure
The easiest way to approach Cyber Essentials is not to wait until the assessment to discover whether you meet the requirements.
Build the controls into normal IT operations.
Regularly:
- Discover your assets
- Assess configuration
- Identify vulnerabilities
- Review access
- Remediate problems
- Reassess
This changes Cyber Essentials from an annual compliance exercise into a reflection of your everyday security posture.
How SecureX7 Helps
Don't discover your security gaps during your Cyber Essentials assessment. Find them before you start.
SecureX7 helps organisations continuously understand their assets, vulnerabilities and security configuration and identify areas requiring remediation.
Instead of manually piecing together information immediately before certification, organisations can maintain ongoing visibility of their security posture.
The objective isn't simply to pass Cyber Essentials.
It's to maintain the controls that Cyber Essentials was designed to encourage in the first place.
Continuous assessment. Guided remediation. Evidence-based compliance.
Related Cyber Essentials Guidance
Readiness Checklist = Am I ready?
Evidence Guide = Can I prove it?
Common Reasons for Failure = What might catch me out?
SecureX7 = Show me what I need to fix.
