Five Key Controls of Cyber Essentials w/ Pre-Self Assessment Checklist Copy

Cyber Essentials tests a company’s IT systems and any device (including desktop, tablets and mobiles). which connects to the internet against five key controls, and the certification process is designed to be straightforward.

What are the key controls?

Boundary firewalls and internet gateways
Malware protection
Patch management
Secure configuration
Access control

Boundary Firewalls and Internet Gateways

You should protect your internet connection with a firewall. This effectively creates a ‘buffer zone’ between your IT network and other external networks.

In the simplest case, this means between your computer (or computers) and ‘the Internet’. Within this buffer zone, incoming traffic can be analysed to find out whether or
not it should be allowed onto your network.

Malware Protection

Malware is short for ‘malicious software’. One specific example is ransomware, which you may have heard mentioned in the news. This form of malware makes data or systems it has infected unusable - until the victim makes a payment. Viruses are another well-known form of malware. These programs are designed to infect legitimate software, passing unnoticed between machines, whenever they can.

Patch Management

No matter which phones, tablets, laptops or computers your organisation is using, it’s important they are kept up to date at all times. Manufacturers and developers release regular updates which not only add new features but also fix any security vulnerabilities that have been discovered. Applying these updates (a process known as patching) is one of the most important things you can do to improve security.

Secure Configuration

Manufacturers often set the default configurations of new software and devices to be as open and multi-functional as possible. They come with ‘everything on’ to make them easily connectable and usable. Unfortunately, these settings can also provide cyber attackers with opportunities to gain unauthorised access to your data, often with ease.

Access Control

To minimise the potential damage that could be done if an account is misused or stolen, staff accounts should have just enough access to software, settings, online services and device connectivity functions for them to perform their role. Extra permissions should only be given to those who need them.

If you're not looking to have your certification managed and automated by ATG and you prefer the self-assessment route, here's a helpful checklist before you get started.

Related Content