Completing the Cyber Essentials questionnaire
What is Cyber Essentials?
Cyber Essentials is a government-backed scheme that helps businesses protect themselves against common cyber threats. Getting certified doesn't just reduce your risk of a cyberattack. It also shows your customers and partners that you take cybersecurity seriously.
Research from Lancaster University found that the vast majority of cyberattacks can be prevented by putting a few basic security measures in place. These measures, known as "controls," are at the heart of Cyber Essentials, a standard designed to help businesses of all sizes strengthen their security. At CyberSmart, we support organisations through every step of getting certified.
Getting Started with the Self-Assessment
To get certified, you'll complete a self-assessment questionnaire, which is then reviewed by an assessor. The questionnaire asks you to review the security of every device used in your business: laptops, PCs, phones, and anything else used for work.
Here's what you'll need to cover:
1. Use Secure Settings on Your Devices and Software
Understand configuration. This simply means finding and adjusting your settings to turn off anything you don't need.
Review your security settings. Check the settings on the devices and apps you use most often.
Use strong passwords. Follow the National Cyber Security Centre's guidance on creating strong passwords, and check your existing ones regularly.
Turn on two-factor authentication (2FA). This adds an extra layer of protection to your accounts, on top of your password.
2. Control Who Can Access Your Data
Understand accounts and permissions. Know who has access to what, and why.
Apply the "least privilege" principle. Give people access to only what they need to do their job, nothing more.
Track admin privileges. Keep a clear record of who has admin-level access, and on which devices.
Set up accounts with restricted access. Create user accounts that limit access by default, to reduce risk.
3. Protect Against Viruses and Malware
Know what you're up against. Understand what malware is and how it can get into your systems.
Put protections in place. Learn how anti-virus software works, and apply at least three ways to guard against malware.
Install and test anti-virus software. Set it up on your devices, then test it to make sure it's working.
Stick to trusted app stores. Only download apps from sources like Google Play or the Apple App Store.
Understand sandboxing. This is a technique that isolates software from the rest of your system, so if something goes wrong, it can't spread.
4. Keep Everything Up to Date
Understand patching. This means updating your software to fix known security gaps.
Turn on automatic updates. Make sure your operating systems and software update themselves wherever possible.
Flag outdated software. Make a list of anything that's no longer supported or updated, and plan to replace or upgrade it.
Next Steps
Working through these areas will put you in a strong position to complete your Cyber Essentials self-assessment and get certified. If you run into any difficulties along the way, we're here to help. We've supported hundreds of SMEs through this process and are happy to guide you through it.
Get in touch with us any time if you need support.