If you are looking for a way to strengthen the security of your business, we would definitely recommend considering becoming Cyber Essentials certified.
Cyber Essentials and Cyber Essentials Plus are two of the most recognised cyber security certifications in the UK. The main purpose of these certifications is to help businesses stay up to date with the latest security requirements, meaning that they are less likely to become compromised.
Although the two certifications are very similar to each other, they are not the same. Cyber Essentials is a great starting point, but Cyber Essentials Plus offers a far greater level of protection and reassurance.
For many businesses, the biggest deciding factor between the two usually falls down to the price and how much preparation is needed to pass.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed cyber security scheme. It is the first certification level that businesses can apply for which covers the basics of keeping a business cyber secure.
Cyber Essentials covers five key areas:
Firewalls
Firewalls control what traffic is allowed in and out of your systems and block any unwanted or unsafe access.
Secure configuration
Devices may come with standard passwords, unnecessary features or unused accounts that create extra risk if they are not updated.
Security update management
Cyber criminals regularly target outdated software because of known vulnerabilities that are easier to exploit and gain access to.
User access control
User access control is about making sure people only have access to the systems and data that they actually need for their role.
Malware protection
Malware is harmful software that can damage systems, steal information or disrupt business operations, e.g. viruses and ransomware.
How does Cyber Essentials work?
Cyber Essentials is completed through a self-assessment questionnaire.You will be expected to answer questions about your systems, devices, software and security processes. This confirms that the key security requirements are in place and being managed properly.
The questionnaire is then submitted through IASME (Information Assurance for Small and Medium Enterprises). Lastly, an assessor reviews your answers, and if everything meets the required standard, your Cyber Essentials certification is issued.
The certification is valid for 12 months. After that, you will need to renew it every year if you want to keep your certification active.
What is Cyber Essentials Plus?
Cyber Essentials Plus covers the same requirements as Cyber Essentials, but it also includes a separate technical audit of your systems, which is completed by an independent assessor.
This means it does not just rely on what your business says is in place, but your systems are being checked by an independent party to confirm that the required protections are in place.
That extra level of testing gives clients and partners more confidence because your security controls have not only been declared, but they have also been independently tested.
What does Cyber Essentials Plus cover?
The technical assessment usually includes checks such as:
Public IP address testing
Your public IP addresses are scanned to check for obvious vulnerabilities that could put your business at risk.
Vulnerability scanning
A sample of your business devices is checked to make sure software is supported, secure and up to date.
Malware protection checks
Devices protected by anti-malware tools are tested to make sure the protection is active and working.
Cloud service checks
Cloud services are reviewed to check that accounts are properly protected, including the use of multi-factor authentication.
Device and configuration checks
Cyber Essentials Plus can also include checks around how devices are configured, how users access systems, and whether unnecessary risks are present.
Key differences between Cyber Essentials and Cyber Essentials Plus
The easiest way to understand the difference is this:
Cyber Essentials shows that your business has reviewed its security setup and meets the basic requirements.
Cyber Essentials Plus proves those protections have been independently tested.
Both are valuable, but provide different levels of reassurance.
Level of assessment
Cyber Essentials is based on a self-assessment questionnaire that is reviewed by an independent certification body.
Cyber Essentials Plus includes technical testing carried out by an assessor.
Level of assurance
Cyber Essentials gives your business a strong foundation and helps show that you are taking cyber security seriously.
Cyber Essentials Plus gives added confidence because your systems have been independently tested in practice.
Preparation required
Cyber Essentials still needs proper preparation, but the process is usually more straightforward.
Cyber Essentials Plus often needs more technical work beforehand because your devices and systems will be tested directly.
Cost Difference
Cyber Essentials Plus usually costs more than Cyber Essentials because it involves additional technical testing.
For some businesses, Cyber Essentials is enough to meet client expectations or contract requirements. Others choose to become Cyber Essentials Plus certified because they want the extra reassurance that comes with independent testing.
Why is Cyber Essentials important for businesses?
Cyber attacks are not just a problem for large organisations because smaller businesses are also being targeted by criminals who know they may not have the same level of protection in place.
Cyber Essentials can help to:
- Reduce the risk of common cyber attacks
- Protect business data and systems
- Build trust with clients and suppliers
- Support tender and contract requirements
- Show a clear commitment to cyber security
- Give staff and stakeholders extra confidence
It also gives your business a useful framework. Instead of guessing what needs fixing.
How Majestec can help
Cyber Essentials can feel like a lot to think about and do, especially if you are not sure what needs checking or where to even start.
Majestec supports businesses through Cyber Essentials and Cyber Essentials Plus preparation, helping you understand what is required and what may need to be improved before you undergo the certification process.
We can review your systems, identify any gaps, improve your security controls, and guide you through the entire process.
We are also proud to be Cyber Essentials Plus certified ourselves. This gives our clients extra peace of mind that our own business has been independently tested and that we take cyber security seriously.
Ready to get Cyber Essentials certified?
If your business is looking to achieve Cyber Essentials or Cyber Essentials Plus, we would be happy to talk you through the next steps.
Get in touch with our team to find out how we can help your business strengthen its cyber security and work towards certification.