Cyber Essentials is where security starts. Don’t let it be where yours stops.

I spend a good part of my week helping businesses get Cyber Essentials, so you might expect me to tell you it’s all you need. I won’t. I think it’s the best first step a UK business can take, and I think treating it as the last step is one of the more common mistakes I see. Is Cyber Essentials enough? For getting started, yes. For being able to say the job is done, no, and it’s worth being clear about why.

First, in its defence

Cyber Essentials gets called a box-ticking exercise, usually by people selling something more expensive. I disagree, and the evidence is on my side.

The scheme asks for five things: a firewall between you and the internet, devices set up securely, updates installed promptly, access limited to the people who need it, and protection against malware. Nothing clever. But those five are aimed squarely at the attacks that hit businesses every day. This week’s NCSC Annual Review says that 88% of the incidents it handled at large organisations began in one of four familiar ways, such as phishing, stolen logins and flaws that already had a fix. The five controls go straight at those.

The insurers’ numbers say the same. According to the NCSC, organisations with the Cyber Essentials controls in place make 92% fewer cyber insurance claims. I can’t think of another purchase at this price that moves a risk that far.

And it’s growing. The same review counted 47,661 certificates awarded in a year, up almost a fifth. The government has just put money behind it too, with a First Step Fund that takes 75% off the assessment fee for smaller organisations that qualify. fromIT holds the certificate itself. I went through the same questions I take clients through, and it’s a useful discipline even when you do this for a living.

So when I say it isn’t enough, please don’t hear “it isn’t worth it”. It is.

What the certificate proves

A Cyber Essentials certificate says that, on the day of assessment, a senior person in your business declared that the five controls were in place, and an assessor reviewed the answers. With Cyber Essentials Plus, an assessor also tests a sample of your devices.

That’s valuable. It’s also a snapshot. The certificate lasts twelve months, and your business will change a great deal in that time. New starters. A new laptop set up in a hurry. An app someone signed up for with a company card. A supplier given access for a project and never removed. A phone that stopped getting updates in the spring.

None of that shows on the certificate on the wall. It’s common to find, in a business with a valid certificate, an admin account that was created for a contractor after the assessment and never closed. The paperwork was accurate when it was signed. The business had moved on and the paperwork hadn’t.

The certificate tells you the five basics were in place on one day. Staying secure is about the other 364.

Ashley Adkins, fromIT

What it was never meant to cover

The scheme is deliberately narrow. It’s designed to stop common, untargeted attacks, and to be achievable by a business with no security staff. That focus is its strength. It also means some important things sit outside it.

• Backups. The scheme recommends them but they aren’t one of the five controls. You can be certified and still have no way back from ransomware.
• A plan for a bad day. Who to call, who decides, what you tell customers. Nothing in the assessment checks that you have one.
• Noticing an attack. The controls are about keeping people out. They don’t ask whether anyone would spot it if someone got in.
• Your suppliers. The assessment looks at your business. It says little about the IT provider, the payroll firm or the software company holding your data.
• Knowing what data you hold. What you have, where it lives and who could be hurt if it leaked.
• People being tricked. A convincing call to accounts asking for a payment to new bank details can get past every one of the five controls. That needs a process, such as ringing back on a known number.

I’m not criticising the scheme for any of this. A first step that tried to cover everything wouldn’t be a first step. But a business that stops here has dealt with the most common ways in and left the question of what happens next unanswered.

The danger of feeling finished

What worries me most is a mood. A business works hard for a few weeks, passes, puts the badge on the website, and quite reasonably feels it has done security. The subject drops off the agenda until the renewal email arrives eleven months later.

Then renewal becomes a scramble to make the answers true again. Old accounts are cleared out, updates are chased, somebody finds the laptop that’s been in a drawer. The certificate is renewed and the cycle repeats. That business is secure for perhaps six weeks a year.

The businesses that get real value from Cyber Essentials treat the assessment as a description of how they work all year. For them renewal takes an afternoon, because nothing has drifted far.

What I’d add on top

None of these needs a big budget. Most need a name, a date and half an hour.

1. A monthly ten-minute check. Who joined and left, and were their accounts dealt with? Is every device still getting updates? Does everyone still have multi-factor authentication? Has anything new been plugged in or signed up for?
2. Backups you’ve tested. Kept separate from your main systems and proven by restoring something. My guide to checking your backups shows how.
3. A one-page incident plan. Numbers to call, who decides what, and a draft message to customers. Printed, because the computer may be the thing that’s unavailable.
4. A callback rule for money. Any change to bank details gets checked by phone, on a number you already hold.
5. Short, regular training. A few minutes a month keeps people alert far better than an hour a year. Lessons from IT is free if you’d like somewhere to start.
6. Three questions for your key suppliers. What of ours can you reach, how is it protected, and how would we hear if something went wrong?
7. Sign up for NCSC Early Warning. It’s free and tells you if your systems show up in data the NCSC sees. Here’s how.

If your customers start asking for more than this, with policies, risk assessments and regular reviews, that’s the point to look at ISO 27001. It’s a different kind of standard. Cyber Essentials checks five technical controls. ISO 27001 checks that you manage security as an ongoing system. Most businesses should do the first well before thinking about the second.

Start here, and keep going

If you haven’t got Cyber Essentials yet, get it. With the First Step Fund running, there has never been a cheaper time, and the free readiness check will show you how close you are in about five minutes.

If you already have it, well done, and I mean that. Now open your calendar and put in a ten-minute check for the first Monday of each month. A certificate you renew once a year tells customers you met the standard. A habit you keep all year is what protects you.