Let’s get you to the right place.
WhatsApp07584 157281Phone01253 364656Emailsupport@comptechits.co.ukCyber Essentials
CompTech helps organisations define the scope, fix technical gaps, gather accurate evidence and prepare for Cyber Essentials or Cyber Essentials Plus assessment. Certification is awarded through the formal scheme.
A recognised baseline
Cyber Essentials focuses on a limited set of important technical controls designed to reduce exposure to common internet-based attacks.
It gives organisations a recognised way to demonstrate that baseline around devices, software, access and malware protection.
Certification can also help with customer or supplier assurance and with contracts or procurement processes where Cyber Essentials is requested, while still remaining a baseline rather than a complete cyber security programme.
Two levels of assurance
Cyber Essentials uses a verified self-assessment covering the organisation’s implementation of the five technical controls.
It provides a recognised baseline and is often the right starting point for organisations that want to demonstrate that the core controls are in place.
Cyber Essentials Plus covers the same five technical controls but adds an independent technical audit of the in-scope environment.
The assessment uses technical checks and representative sampling to verify that the controls are working in practice, rather than relying only on the organisation’s questionnaire responses.
Cyber Essentials Plus does not mean an organisation is fully secure or protected from every attack.
Five technical controls
Check that devices and services are not unnecessarily exposed and that appropriate firewall controls are in place.
Remove unnecessary software, services and default settings that could make devices easier to compromise.
Keep supported operating systems, firmware and applications updated so known vulnerabilities are not left open.
Limit administrative access, remove unnecessary privileges and make sure users only have access appropriate to their role.
Use appropriate controls to reduce the risk from malicious software and unsafe applications.
Define the scope
The organisation applying for certification is responsible for defining its assessment boundary and agreeing the scope with the Certification Body before assessment begins.
CompTech can help map the users, devices, networks, cloud services and externally managed systems involved, identify potential exclusions and make sure the proposed scope is understood before evidence is prepared.
Under the current requirements, cloud services that host or process organisational data or services must be included in scope rather than simply excluded for convenience.
For Microsoft 365 identity, access and tenant management, see our Microsoft 365 support approach.
Prepare early
Finding these issues early gives the organisation time to remediate them before the formal assessment begins.
For ongoing management of supported devices, updates and patching, see our managed IT support approach.
Certification readiness
Understand the current environment, proposed scope and likely gaps before the assessment begins.
Fix technical issues that could prevent certification.
Gather the information needed to complete the verified self-assessment accurately.
Review the final position so the organisation understands what will be submitted and, for Cyber Essentials Plus, what may be technically tested.
CompTech helps with readiness and preparation. Certification is awarded through the formal scheme, and no preparation process can guarantee an assessment result.
Technical verification
Cyber Essentials Plus adds technical verification of the Cyber Essentials controls. The assessment uses technical checks across the in-scope environment, including representative sampling rather than testing every device individually.
Preparation can include checking representative devices, security updates, account separation, MFA, firewall exposure, malware protection and assessment information before the Plus audit.
Beyond certification
Cyber Essentials gives organisations a strong baseline, but risks continue to change after certification.
Identity monitoring, Microsoft 365 security, staff awareness, backup, vulnerability management and recovery planning may still need attention depending on the organisation.
Maintain the baseline
Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months and need to be renewed annually. Certification reflects the environment at a point in time, so changes during the year can affect whether the controls still match the certified position.
The scheme requirements can also change between renewals, so recertification should be prepared against the current requirements rather than simply reusing the previous year’s answers.
Prepare for assessment
Tell us whether you are aiming for Cyber Essentials or Cyber Essentials Plus and what your current IT environment looks like.
We’ll help you understand the proposed scope, identify technical gaps and work through the preparation needed before formal assessment.