Maybe a client has asked for it. Maybe a tender form had a box you couldn’t tick. Or maybe you just want proof that your business takes security seriously.
Whatever brought you here, Cyber Essentials Cheshunt firms are being asked about is a lot more achievable than it sounds. The trick is preparing properly before you apply.
What Is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme that shows your business has basic protections in place against the most common online attacks. The standard level is a self-assessment. You answer a set of questions about your IT setup, and an approved certification body reviews your answers. Certification lasts for 12 months, so it’s renewed every year. Cyber Essentials certification is required for many central government contracts. More and more private sector clients now ask for it too.The Five Security Controls
Everything in the scheme comes back to five security controls. If you understand these, you understand most of what’s being asked.- Firewalls. Every device connecting to the internet needs a firewall that’s switched on and properly set up, including laptops used at home.
- Secure configuration. Default passwords changed, unnecessary software removed, and auto-run features turned off.
- User access control. People only get the access they need. Admin accounts are kept separate and used only for admin tasks. Multi-factor authentication protects cloud services.
- Malware protection. Antivirus or similar protection on devices, kept up to date.
- Security update management. Software must be supported and patched. Critical and high-risk updates should be applied within 14 days of release.
Start With a Device and Software List
This is the step people underestimate. You need to know every laptop, desktop, phone, tablet and server that accesses business data, plus the operating systems and software on them. Old devices are often the sticking point. If a laptop is running an operating system that no longer receives updates, it either needs upgrading or removing from scope.Check Your Cloud Services
Microsoft 365, Google Workspace, accounting software, CRMs. If your business uses it online, it’s likely in scope. The big requirement here is multi-factor authentication. Make sure it’s switched on for every user, not just the ones who remember.Common Reasons Businesses Fail
From experience, these trip people up most often:- Unsupported software still in use
- Staff working with admin rights on everyday accounts
- Personal phones accessing work email without any controls
- Missing MFA on one or two cloud services
- Router default passwords never changed
