CYBER ESSENTIALS
Prepare for a Cyber Essentials Assessment
Cyber Essentials is much easier when you know you're ready before you start.
Preparing for Cyber Essentials isn't simply about completing a questionnaire. It means understanding your technology environment, checking that the required security controls are genuinely in place and being able to provide accurate information about how those controls are implemented.
Good preparation can make the assessment considerably smoother.
It can also uncover security weaknesses before they become assessment problems.
The objective should therefore be more than simply passing Cyber Essentials:
Understand your environment. Check your controls. Fix the gaps. Be ready to demonstrate your security posture.
Readiness Checklist
Are you ready to begin?
Before starting your Cyber Essentials assessment, it's worth carrying out a structured readiness review.
Begin with the fundamentals.
Understand your scope
Know which parts of your organisation are included within the assessment and which devices, systems, users and services need to be considered.
Know your assets
You should have a clear understanding of the laptops, desktops, servers, mobile devices, network equipment and cloud services your organisation uses.
Know your software
Identify the operating systems and applications running across those assets.
Look particularly for unsupported or obsolete software, as this can create both a security and certification problem.
Check the five technical controls
Review your environment against the five core areas of Cyber Essentials:
Firewalls
Is access from the internet appropriately controlled?
Secure Configuration
Are devices securely configured and unnecessary software and services removed?
Security Update Management
Is software supported and are important security updates being installed within the required timeframe?
User Access Control
Do users only have the access they require and are administrator privileges appropriately controlled?
Malware Protection
Are appropriate controls in place to prevent malicious software from executing?
Check MFA
Review your cloud services and ensure multi-factor authentication is appropriately implemented and enforced.
A good readiness review should leave you able to answer one fundamental question:
Could we demonstrate that these controls are actually operating across our environment today?
Evidence Guide
Be prepared to support your answers
Cyber Essentials is ultimately about your organisation's actual security controls rather than simply its written policies.
That makes accurate, current information important.
Depending upon the question and your environment, useful evidence and supporting information might include:
- Asset and software inventories
- Operating-system and application versions
- Security update and vulnerability status
- Firewall and network configurations
- User and administrator account information
- MFA settings
- Secure configuration information
- Malware-protection settings
- Information about cloud services
- Processes for onboarding and removing users
The objective isn't necessarily to produce mountains of documentation.
It's to be able to confidently support the answers you provide.
Evidence should reflect today — not six months ago
IT environments continually change.
New employees arrive. Others leave. Devices are replaced. Applications are installed. Cloud services are adopted. New vulnerabilities emerge.
A spreadsheet or screenshot created several months ago may therefore no longer accurately represent your environment.
Where possible, evidence should be based upon current information and actual configuration.
Common Reasons Organisations Fail
Small gaps can create big problems
Organisations don't necessarily struggle with Cyber Essentials because they have poor cyber security.
Often the problem is a relatively small number of overlooked issues.
Common examples include:
Unsupported software
An old application or operating system is still in use and no longer receives security updates.
Missed security updates
A qualifying vulnerability hasn't been remediated within the required timeframe.
Incomplete MFA coverage
MFA exists, but isn't enforced for every relevant user or cloud service.
Excessive administrator access
Users have privileged access that isn't genuinely required.
Dormant accounts
Former employees or unused accounts remain active.
Unnecessary software or services
Old applications and background services remain installed and increase the attack surface.
Overly permissive firewall rules
Systems or services are accessible from the internet unnecessarily.
Incomplete asset visibility
Devices, applications or services have simply been forgotten.
And perhaps the most important:
What you think is happening isn't necessarily what is happening
Your policy might state:
"Critical security updates are installed within 14 days."
But are they?
Your IT team might believe:
"All users have MFA enabled."
But does that include every user, administrator, cloud application and exception?
This difference between intended security posture and actual security posture is where many compliance problems originate.
A Better Way to Prepare
Cyber Essentials preparation doesn't need to become a frantic exercise immediately before an assessment.
A more effective approach is to treat compliance as the result of maintaining good security continuously.
Discover
Understand the devices, applications and services operating across your environment.
Assess
Check them against appropriate security and configuration requirements.
Identify
Find vulnerabilities, configuration weaknesses and compliance gaps.
Prioritise
Understand which issues present the greatest risk or require urgent attention.
Remediate
Take appropriate action to correct the problem.
Reassess
Confirm that the change has actually resolved the issue.
Evidence
Maintain visibility of your current security posture so you're better prepared when assessment time arrives.
In other words:
Don't prepare for Cyber Essentials once a year. Maintain Cyber Essentials readiness throughout the year.
How SecureX7 Helps
Move from assumption to evidence
SecureX7 helps organisations understand their actual security posture by continuously assessing assets, vulnerabilities, secure configuration and compliance requirements.
Rather than relying entirely on questionnaires, spreadsheets and periodic manual checks, SecureX7 can help identify where your environment aligns with required controls and importantly, where it doesn't.
When a problem is identified, SecureX7 helps provide the information required to understand the issue, prioritise it and determine the appropriate remediation.
The environment can then be reassessed to confirm the problem has been addressed.
Discover → Assess → Identify → Remediate → Reassess → Evidence
Cyber Essentials shouldn't be a snapshot
Passing an assessment provides valuable assurance.
But security doesn't stop on the day the certificate is issued.
Configurations change. New software appears. New vulnerabilities are discovered. Users come and go.
SecureX7 is designed around the principle that security and compliance should be continuously assessed rather than periodically assumed.
Prepare for Cyber Essentials. Prove your controls. Then keep them that way.
