Cyber security is no longer something that only large organisations need to worry about. Businesses of every size rely on technology to operate, communicate with customers and suppliers, store information and deliver their services.
For small and medium-sized businesses (SMEs), a cyber attack can have a significant impact. With potentially limited resources, a security incident can result in operational disruption, financial losses, reputational damage and lost customer confidence.
This is where Cyber Essentials Plus can play an important role.
What is Cyber Essentials Plus?
Cyber Essentials is a UK government-backed certification scheme designed to help organisations protect themselves against common cyber threats.
There are two levels of certification:
Cyber Essentials: an organisation completes a self-assessment covering key areas of cyber security.
Cyber Essentials Plus: includes the same core requirements, but adds an independent technical assessment to test whether the organisation's security controls are working as expected.
This independent assessment is one of the key differences between the two certifications.
Rather than relying solely on an organisation's own assessment, Cyber Essentials Plus involves technical testing of its IT environment.
1. It helps identify weaknesses
Cyber security can be difficult to assess from the inside.
An SME might have antivirus software, firewalls, secure passwords and regular backups in place, but that doesn't necessarily mean every part of its IT environment is configured securely.
Cyber Essentials Plus provides an opportunity for an independent assessment of key security controls.
The process can help identify weaknesses that might otherwise go unnoticed, allowing the business to address them before they become a bigger problem.
2. It provides reassurance to customers
Customers increasingly want to know that the businesses they work with take cyber security seriously.
This is particularly important for SMEs that handle customer information, financial data or commercially sensitive information.
Holding Cyber Essentials Plus certification provides an independently assessed demonstration that an organisation has implemented specific fundamental security controls.
It doesn't guarantee that a business cannot suffer a cyber attack, but it can provide customers and stakeholders with greater confidence in the organisation's approach to cyber security.
3. It can support winning new business
Cyber security is increasingly becoming part of the procurement process.
Larger organisations may ask suppliers and contractors to demonstrate that they meet particular security standards before they can work with them.
For some contracts, Cyber Essentials or Cyber Essentials Plus may be a requirement.
Having certification can therefore help SMEs demonstrate that they meet certain security requirements when tendering for work or entering into new supplier relationships.
4. It creates a recognised security baseline
Cyber security can feel overwhelming, particularly for a smaller business trying to work out where to start.
There are countless security products, technologies and recommendations available, and it can be difficult to know which areas should take priority.
Cyber Essentials focuses on a defined set of fundamental technical controls.
These include areas such as:
Firewalls and network security
Secure configuration
Security update management
User access control
Malware protection
This provides SMEs with a recognised baseline from which they can develop their wider cyber security strategy.
5. It encourages businesses to look at security proactively
One of the biggest advantages of a structured security assessment is that it encourages businesses to look at their IT security before something goes wrong.
Rather than waiting for a security incident to expose a weakness, businesses can take a proactive approach to identifying and addressing vulnerabilities.
For an SME, that proactive approach can be particularly valuable. The cost and disruption associated with dealing with a cyber incident can be significant, while preventative measures can help reduce exposure to common threats.
There isn't a single answer for every business. The value of certification will depend on the organisation, the information it handles, its customers and suppliers, its industry and its wider security requirements.
However, for many SMEs, Cyber Essentials Plus can provide a useful combination of independent assurance, a recognised security framework and evidence of a proactive approach to cyber security.
It can also help businesses have more informed conversations about their IT security and identify areas where further improvement may be needed.
Cyber security is an ongoing process. Achieving Cyber Essentials Plus shouldn't be viewed as the end of an organisation's cyber security journey; it and needs to be reviewed and achieved each year. Not least because technology changes, businesses grow, employees join and leave and new threats emerge.
Keeping systems secure therefore requires regular attention and review.
For SMEs, the most important question isn't simply: “Are we Cyber Essentials Plus certified?” it’s “Are we continually taking steps to reduce our cyber risk?”
If you're not sure whether your business is doing enough to protect itself, talk to us.
We can help you understand where your current IT security stands and where there may be opportunities to strengthen it.