Cyber Essentials requirements explained: video brief

Technical settings, not clauses

The National Cyber Security Centre publishes the Cyber Essentials requirements as Requirements for IT Infrastructure, now at version 3.3, and IASME's question set tests them. There are no clauses to interpret: each requirement is a technical setting or practice that must be true of every device, account and service in scope, and some questions are automatic fails. This short film walks through them.

Scope comes first. The assessment covers the whole IT infrastructure used for the business, or a well-defined, separately managed sub-set segregated by a firewall or VLAN, agreed with the certification body before assessment begins. A scope statement names each legal entity, the network boundary and the locations, together with end-user devices, servers, home and remote working, personal devices that reach organisational data, and the cloud services in use.

The five controls

Firewalls protect every device in scope from untrusted networks, with rules that are justified and reviewed. Secure configuration removes unnecessary software and accounts, changes default passwords and disables features that are not needed. Security update management keeps operating systems, applications and firmware licensed, supported and patched within the required time. User access control limits accounts to those who need them, separates administrative access and applies strong authentication. Malware protection ensures that malicious software cannot run, through approved methods.

Cyber Essentials is a verified self-assessment marked by an IASME-licensed certification body; Cyber Essentials Plus adds a technical audit within three months of that certificate. Both expire after 12 months. The scheme is relevant to organisations of any size, and especially to suppliers to UK government, NHS and defence buyers and to companies that make it a condition of contract.

Some answers fail the assessment outright: unsupported software anywhere in scope, a cloud service without multi-factor authentication where it is available, or a critical or high-risk update left unapplied beyond the scheme's deadline. Part of an organisation can be certified only if it is a well-defined, separately managed sub-set segregated by a firewall or VLAN; end-user devices must be included and cloud services cannot be excluded. ISO/IEC 27001 certifies a risk-based management system, so a buyer that names Cyber Essentials usually still expects the certificate.