Self-assessment questionnaire External vulnerability scan ...

1 CREST has a large number of Certifying Bodies whose details are available on both the Cyber Essentials website and on the CREST website - which also profiles each company to help organisations make their selection and move to formally appoint. How it works Self-assessment questionnaire External vulnerability scan*. CYBER ESSENTIALS: An Overview Internal vulnerability scan and on-site assessment Delivered by CREST-accredited Certification Bodies A primary objective of the UK Government's National Further Information Cyber security Strategy is to make the UK a safer The following additional information is available from : place to do business. A comprehensive Guide to the Cyber Essentials scheme Cyber Essentials is a cyber security standard that uses independent assessment to identify the IT security controls that an organisation Cyber Essentials Common questionnaire needs to have in place to have confidence that they are addressing Cyber Essentials Plus Common Test Specification cyber security effectively and mitigating the risk from internet-borne threats.

2 An organisation's technology that is exposed to common CREST member companies providing Cyber Essentials certification services cyber-attacks will typically include internet connected computers, such Short awareness training courses as desktop PCs, laptops, tablets and smartphones, along with internet connected servers such as email, web and application servers. CREST (GB) Ltd, .Abbey House, 18-24 Stoke Road, Slough, Berkshire SL2 5AG..Tel: 020 3058 3122 email: About Cyber Essentials into the decision making process. Ultimately Any organisation procuring Cyber Essentials the decision on which level to certify against is services can be assured that CREST Cyber The Cyber Essentials scheme focuses on the following five essential mitigation strategies: influenced by an organisation's cyber security Essentials Certifying Bodies have: stance and those of its business partners, Demonstrated appropriate levels of quality suppliers and stakeholders.

3 Assurance processes, security controls, Once an organisation is assessed against the security assessment methodologies and met Cyber Essentials security criteria and passes, additional qualification criteria it will receive the relevant Cyber Essentials Secure Boundary Access control Patch Malware Proven access to technically competent and award (badge) based on the level of certification configuration firewalls and administrative management protection qualified staff achieved. This demonstrates that it has achieved and internet privilege gateways management a fundamental level of cyber security . Committed to abiding to the requirements of Certification Bodies for Cyber Essentials The scheme provides organisations with clear provides organisations with independent validation Appointing a Certifying Body to Signed an enforceable Code of Conduct guidance on implementation, as well as offering of elements of the questionnaire .

4 Carry out the assessment In addition to Cyber Essentials certification independent certification for those who want it. After services, CREST Certifying Bodies also provide a The key differentiator for Cyber Essentials PLUS Once a decision has been reached to proceed certification, an organisation is able to demonstrate range of other services to help organisations better is the inclusion of a technical review of the with a Cyber Essentials certification, a Certifying to customers that its data is adequately protected manage their cyber security risks. These include: organisation's workstations. This additional phase Body must be appointed to carry out the and that it takes cyber security seriously. There are of testing increases the validity of certification assessment . Organisations have a number of two levels of certification: Penetration testing considerably by providing evidence of compliance suppliers to choose from.

5 Value can be gained against the following scenarios: by appointing a supplier who is certified and security audit and compliance Cyber Essentials - organisations complete a Self-assessment questionnaire which is possesses accredited consultants because security policy Can malicious files enter the organisation reviewed by an External Certifying Body the combination of these features provide an from the Internet through either web traffic security architecture organisation with the greatest assurance and Cyber Essentials Plus - tests of the or email messages? confidence that an effective and professional Cyber security incident response organisation's systems are carried out by an Should malicious content enter the assessment has been performed. Many External Certifying Body Threat intelligence organisation, how effective are the anti-virus organisations, however, face a challenge in An overview of them is described below.

6 This takes away much of the stress in and malware protection mechanisms? identifying trusted suppliers that have access to validating the competence of the cyber security competent, qualified experts. Should the organisation's protection assessors and almost certainly ensures a faster Getting your Business Certified mechanisms fail, how likely is it that the CREST is a not-for-profit accreditation body route to certification. Both Cyber Essentials and Cyber Essentials organisation will be compromised due to whose role is to create and maintain high Any Certifying Body will be able to talk through PLUS include a questionnaire which relates to failings in the patching of the organisation's standards within the cyber security sector and the requirements and scoping necessary security controls and the secure configuration of workstations? to drive a consistency of quality across its for Cyber Essentials or Cyber Essentials an organisation's computing resources.

7 CREST Cyber Essentials PLUS is a more thorough member organisations to offer assurance to the Plus assessments and help organisations to Certifying Bodies also conduct an External assessment of the organisation and, as a result, buying community. understand their options. vulnerability scan as part of a remote technical provides greater security assurance. However, it assessment at the Cyber Essentials level. This does come at an additional cost, which will factor