An introduction to Cyber Essentials

"Cyber Essentials" is a government-backed, industry-supported scheme to help organizations protect themselves against common online threats. It is mandatory for central government contracts which involve handling personal information and providing certain ICT products and services.

Here is a general guideline for what you might need to do to comply with the Cyber Essentials scheme:

1. Secure Your Internet Connection

The first step in achieving Cyber Essentials compliance is to secure your internet connection by using a firewall. This can be a software or hardware device that provides a basic level of protection for your computer or network.

2. Secure Your Devices and Software

This involves keeping your devices and software up to date. Install the latest security patches and updates for all your devices and software.

3. Control Access to Your Data and Services

You need to ensure that only those who should have access to your data and services do. This involves setting up user accounts and access levels, as well as administrative privileges.

4. Protect from Viruses and Other Malware

You will need to have anti-malware software installed and regularly updated on all devices. This can help protect against viruses, ransomware, and other forms of malware.

5. Keep Your Devices and Software Up to Date

Manufacturers and developers release regular updates which not only add new features but also fix any security vulnerabilities that they have discovered.

6. Training and Awareness

All staff members should be aware of the risks and know what actions they should take to mitigate them. Regular training sessions can help to ensure that all staff members are aware of the latest threats and know how to deal with them.

7. Incident Management

Have a plan in place for managing any security incidents that do occur. This should include a process for reporting incidents and a plan for how to respond to them.

8. Backup and Recovery

Regularly back up all your data and test your backups to ensure you can recover from a data loss event. This should include both onsite and offsite backups

9. Risk Assessment

Regularly conduct a risk assessment to identify any potential threats to your organization. This will help you to identify any areas where you may be vulnerable and develop a plan to address these risks.

10. Certification