What is Cyber Essentials and why does it matter to SMEs?

Most of the attacks that hit small and medium-sized businesses do not rely on sophisticated techniques. They exploit weak passwords, out-of-date systems, forgotten accounts and services that are exposed for no good reason. Cyber Essentials, a scheme created by the UK government, starts from exactly this observation: there is a minimum set of technical measures that significantly reduces a business's exposure to the most common attacks. Even for businesses that never intend to seek certification, in the UK or elsewhere in Europe, it works as a clear, objective roadmap.

Where Cyber Essentials comes from

Cyber Essentials was launched in 2014 by the UK government and is now overseen by the NCSC (National Cyber Security Centre), the UK's national cyber security authority. Since 2020, the IASME Consortium has been the partner responsible for running the scheme, which includes accrediting certification bodies and maintaining the question set used in assessments.

The aim was never to cover every aspect of information security. The goal is to set a baseline: a small number of well-chosen controls that any organisation can implement without a dedicated security team. That is why the scheme has been so widely adopted by small businesses, suppliers to the UK public sector and the supply chains of large companies.

The five technical controls

The whole scheme revolves around five controls. Each one addresses a common form of attack:

• Firewalls: control what comes into and goes out of the network and devices, closing ports and services that do not need to be reachable from the internet.
• Secure configuration: removes dangerous factory settings, such as default passwords, unnecessary accounts and automatic execution of files.
• Security update management: ensures that systems and applications receive security fixes within defined timeframes.
• User access control: ensures that each person has only the access they need, with appropriate authentication.
• Malware protection: prevents or limits the execution of malicious software on the business's devices.

The article on the five basic cyber security controls covers each of them in practical terms.

Cyber Essentials and Cyber Essentials Plus

The scheme has two levels. Under Cyber Essentials, the business completes a self-assessment questionnaire, which is reviewed by an assessor from a certification body. The answers must be signed off by a senior person in the organisation, which gives formal weight to what has been declared.

Under Cyber Essentials Plus, the same controls are verified through a technical audit, carried out on site or remotely. The assessor tests a sample of devices, checks that updates are current, simulates the arrival of malicious files and confirms that multi-factor authentication is enabled where it should be. In both cases, certification is valid for one year and must be renewed.

Why this matters to an SME

For most businesses, Cyber Essentials is voluntary, and outside the UK it has no regulatory standing. Even so, there are good reasons for an SME manager to get to know it:

• It is a focused selection. Broad information security standards are valuable, but they can seem out of reach for a business of twenty people. Cyber Essentials states clearly what to do first.
• It has verifiable criteria. Deadlines for applying updates, a requirement for multi-factor authentication on cloud services, removal of accounts that are no longer used. These are requirements that can be checked, not just intentions.
• It aligns with data protection law. The UK GDPR, for example, requires appropriate technical and organisational measures to keep personal data secure, and the EU GDPR contains the same requirement. A well-implemented technical baseline helps demonstrate due diligence, a topic explored in cyber security and the UK GDPR.
• It makes conversations with your IT provider easier. Many SMEs outsource their IT. Having a clear list of controls makes it easier to ask what is being done and to request evidence.

What the scheme does not cover

Being clear about its limits is as important as knowing the controls. It does not address, for example, backups, incident response planning, staff awareness or business continuity. These topics remain necessary and need to be dealt with separately.

Nor is it a guarantee. The controls reduce the likelihood that the most common attacks will succeed, but they do not eliminate the risk. A business that implements the five controls well is in a much better position than average, and should keep reviewing its practices.

Where to start

A simple first step is to draw up an inventory: which computers, mobile phones, servers and cloud services the business uses, who manages each one and whether they are still supported by the manufacturer. From there, it becomes easier to assess each control and identify the most urgent gaps.

• List all devices and cloud services used by the business.
• Check whether any system no longer receives updates from the manufacturer.
• Confirm that multi-factor authentication is enabled on email and the main cloud services.
• Identify who has administrator access and whether it is still needed.
• Appoint someone internally to keep track of these points throughout the year.