Certification

Cyber Essentials

Organisations looking to improve their cyber security and protect themselves from the most common cyber attacks should look to achieve Cyber Essentials. This simple and effective scheme will assess your organisation against five basic security controls. These controls will immediately strengthen your cyber defences against internet based attacks.

The Cyber Essentials scheme is available as a self- assessment questionnaire or as an audited version (Cyber Essentials Plus). Cyber Essentials Plus provides greater level of assurance following additional hands-on technical verification of your cyber security by independent professionals.

Get ready for Cyber Essentials

The Cyber Essentials Readiness Tool helps you meet Cyber Essentials requirements. The tool includes questions related to the main Cyber Essentials criteria and provides tailored advice to prepare you for certification.

Selecting a Certification Body

Certifying Bodies are professional companies that have been licensed to deliver Cyber Essentials assessments and offer consultancy services to help organisations achieve the certification.

• Certifying Bodies based and operating in Scotland are listed on the Cyber and Fraud Centre – Scotland website.
• You can see the full list of certification bodies on the IASME consortium website.

Working with an external IT company

If your organisation outsources its IT to a third-party provider, you will need to instruct your IT provider to implement the Cyber Essentials controls to your network on your behalf.  The IT provider will manage your network for you, however the responsibility for your network security is still yours.

To help you manage the responsibility of your cyber security, IASME has created a detailed list of questions for you to download and give to your third-party provider. Ask your IT provider to return the answers and the relevant lists to you so that you can check that your organisation meets the Cyber Essentials requirements. You can find more information here.

You should also have a Service Level Agreement (SLA) and contract with any third-party IT supplier.

It is highly recommended that you look for an IT provider that is Cyber Essentials certified. The IT Managed Services directory has over 170 Scottish companies who provide IT Managed Services, and will easily identify those that are both cyber resilient themselves through the Cyber Essentials programme, while also showing providers who offer vital security services.

If you need to refer to the requirements, all supporting documentation for the scheme can be found on the NCSC website.