Cyber Essentials Accreditation

To get certified in Cyber Essentials Plus, you must first obtain the basic Cyber Essentials certification. Then, you need to undergo a technical audit conducted by an external certifying body, which includes on-site or remote audits and vulnerability scans. If any issues are identified, they must be addressed before certification is granted. Once all requirements are met, you will receive the Cyber Essentials Plus certificate, valid for one year. It must be completed within 3 months of achieving Cyber Essentials accreditation.

Learn more about Cyber Essentials Plus. 

Cyber Essentials is the entry-level certification that involves a self-assessment questionnaire reviewed by a certifying body. Cyber Essentials Plus is a higher-level certification that builds upon Cyber Essentials by including an independent audit. This audit involves technical expert verification of systems, vulnerability scans, simulated attacks, and cloud security checks to ensure the effectiveness of security measures in practice. Essentially, Cyber Essentials is self-assessed, while Cyber Essentials Plus is independently audited and tested.

Learn more about Cyber Essentials vs Cyber Essentials Plus.

The five key security controls of Cyber Essentials are:

1. Firewalls: To block unauthorised access to your systems.
2. Secure Configuration: Ensuring devices and software are optimised for security, including changing default passwords and disabling unused services.
3. Security Update Management: Keeping all devices, apps, and operating systems up to date to close security loopholes.
4. Malware Protection: Using antivirus or anti-malware tools on all devices and ensuring they are maintained.
5. User Access Control: Granting employees access only to the data and tools they need for their job and restricting administrative rights.

You can read more about Cyber Essentials Checklist & Requirements.

ISO 27001 is the international standard for information security, focusing on establishing an Information Security Management System (ISMS) to manage security risks. It covers all areas of information security, including IT and non-IT, and involves conducting risk assessments, establishing security policies, and continuously monitoring security practices. Cyber Essentials, on the other hand, focuses specifically on IT infrastructure and common cyber threats, aiming for basic security controls. ISO 27001 is more comprehensive, internationally recognised, and better suited for larger or global organisations, while Cyber Essentials is simpler and designed for SMEs.

Learn more about Cyber Essentials vs ISO 27001.

The NIS2 Directive is an EU mandate aimed at strengthening cybersecurity within critical services and digital infrastructure. It applies mainly to operators of essential services like energy, healthcare, and finance, as well as large digital service providers, including UK organisations working within the EU. Compliance involves conducting risk assessments, developing incident response plans, and maintaining continuous system monitoring. It's not a certifiable accreditation but creates legal obligations that businesses must follow.

Learn more about cyber security accreditations.