Cyber Essentials provides an important foundation for protecting UK businesses against common cyber threats. But achieving certification raises another question: what happens when an attacker manages to bypass those defences?
Why Cyber Essentials certification should be the beginning of your cyber security journey, not the end.
For many organisations, achieving Cyber Essentials or Cyber Essentials Plus is a significant milestone. It demonstrates a commitment to implementing recognised security controls, protecting information and managing cyber risk.
Increasingly, certification is also a commercial requirement. Customers, insurers, supply chains and procurement frameworks are placing greater emphasis on cyber security assurance.
And rightly so.
The five technical controls within Cyber Essentials address common weaknesses that cyber criminals routinely exploit. They provide a recognised baseline that every organisation should take seriously.
However, there is an important distinction between demonstrating that security controls are in place and having the ongoing capability to detect and respond to an attack.
Certification provides valuable assurance. It does not guarantee continuous protection.
Cyber Essentials Certification and Continuous Cyber Security
Cyber Essentials assesses an organisation against five technical control areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
Cyber Essentials Plus goes further, introducing independent technical testing to verify that these controls are working effectively within the scope of certification.
Both are valuable achievements that can materially reduce cyber risk. However, neither certification is designed to replace continuous security monitoring, threat investigation or incident response. An organisation may successfully achieve Cyber Essentials Plus and subsequently experience a compromised user account, a sophisticated phishing attack or suspicious activity involving its cloud applications.
Certification is also renewed annually, while cyber threats and an organisation’s technology environment can change from one day to the next. The important question for business leaders is therefore not simply whether their organisation meets a recognised security standard.
The objective is to have the visibility and capability to identify, investigate and respond when preventative security controls are bypassed.
The Threat Has Changed. Has Your Cyber Security Strategy?
Traditionally, much of an organisation’s cyber security investment focused on preventing attackers from gaining access to its network. Firewalls, antivirus software, patch management and access controls remain essential. They reduce vulnerabilities and help prevent many common attacks. But modern cyber attacks are not exclusively about breaking into networks or deploying ransomware.
Attackers increasingly target legitimate user credentials, exploit trusted identities and attempt to move between connected systems and cloud applications. In some cases, an attacker may not need to deploy traditional malware at all. They may gain access to a legitimate account and begin operating within systems that the organisation already trusts. This presents a challenge for businesses relying primarily on preventative security controls.
An organisation can have well-managed devices, strong access policies and recognised certification, yet still lack the visibility needed to identify unusual activity across its environment.
Consider a compromised employee account being used to access sensitive information outside normal working patterns. Would your organisation recognise that behaviour? Who would investigate it? And how quickly could appropriate action be taken?
These questions highlight the distinction between preventative security and operational cyber resilience.
Prevention helps reduce the likelihood of an attack succeeding.
Detection and response help organisations recognise suspicious activity, investigate potential threats and limit the impact of a successful compromise.
Both are essential.
Moving Beyond Cyber Essentials to Continuous Protection
At Amicis Group, we believe cyber security should be proportionate to the risks an organisation faces, its operational requirements and the potential consequences of an incident.
For many small and medium-sized businesses, the next step beyond Cyber Essentials is to introduce ongoing security management and detection capabilities.
Our CyberGuard managed cyber security service brings together preventative controls, vulnerability management, identity security and managed detection capabilities within a structured service.
It is designed to help businesses maintain their security foundations while gaining greater visibility of potential threats as their people, technology and business requirements evolve.
For organisations operating more complex environments, managing larger volumes of sensitive information or facing greater operational and regulatory demands, a managed Security Operations Centre (SOC) may be appropriate.
Through our Managed SOC and Security Information and Event Management (SIEM) services, Amicis Group provides continuous security monitoring, specialist
✓ Monitor and detect cyber threats 24/7
✓ Investigate and respond to incidents faster
✓ Strengthen resilience with expert-led security
