Cyber Essentials is entering a new era of accountability says Wavenet CISO Paul Colwell
With more than 41,000 live Cyber Essentials and 13,000 Cyber Essentials Plus certifications held by organisations across the UK, the government-backed scheme has become a benchmark for cyber security best practice.
With the latest update to the standard (known as the Danzell update), scheme administrators IASME and the National Cyber Security Centre (NCSC) are aiming to strengthen the credibility of Cyber Essentials by introducing tighter controls, more rigorous validation and increased scrutiny around how organisations implement and evidence core security measures.
In particular, organisations must demonstrate that controls such as multi-factor authentication (MFA), patch management and access controls are consistently applied across their environment, rather than partially implemented or simply documented in policy.
Verifiable resilience
Paul Colwell, Chief Information Security Officer at Wavenet, an IASME-accredited Certification Body that supports more than 500 organisations through the Cyber Essentials process, believes these changes reflect a broader shift within the cyber security industry away from self-declared compliance and towards verifiable resilience.
He said: “Cyber Essentials has always been designed to help organisations get the fundamentals right. What’s changing is the level of assurance behind it. The focus is moving away from what organisations say they’re doing towards what they can prove. That’s a positive development for the industry because it strengthens confidence in the certification and helps ensure it remains a meaningful benchmark for cyber resilience.”
Stricter requirements
The update also introduces stricter requirements for organisations pursuing Cyber Essentials Plus certification. Independent technical audits will place greater emphasis on patch management and remediation, with vulnerabilities identified anywhere within an organisation’s environment potentially impacting certification outcomes.
Doing the basics – consistently
Colwell adds that the changes highlight a broader challenge facing many organisations, notably the gap between perceived and actual cyber readiness revealed by incomplete or inconsistent MFA coverage, uneven patch management across Paul Colwell systems, poorly defined or inadequately secured network boundaries and reliance on policy documentation without corresponding technical enforcement.
He said: “Cyber Essentials has always been about protecting organisations against the most common forms of internet-based cyber- attack. A large portion of cyber incidents we see still come back to the basics – patching, identity, access control and configuration management. The updated standard reinforces the importance of doing those things consistently, and that’s good news for organisations that take security seriously.”
Be First to Comment