Strengthening Cyber Security
Strengthening Cyber Security
Strengthening Cyber Security
Strengthening Cyber Security
Minimise Threats with Cyber Essentials Certification
As a professional organisation operating within the security and fire safety sectors obtaining Cyber Essentials certification is a proactive measure to safeguard your systems, establish trust with clients and ensure compliance with legal and contractual cyber security requirements.
This certification serves as a means of reassuring your customers by demonstrating best practice.
Cyber Essentials is a Government-backed certification scheme which concentrates on five key technical controls specially designed to protect against the most common internet-based cyber security threats affecting businesses:
- Boundary firewalls and internet gateways
- Secure configuration
- Access control
- Malware protection
- Security update management
By implementing these technical controls, your organisation significantly reduces the risk of cyberattacks.
The scheme offers a cost effective self-assessment solution suitable for organisations of all sizes and the government mandates that all suppliers bidding for contracts involving sensitive information or specific technical products must hold Cyber Essentials certification.
There is also a Cyber Essentials Plus option where a qualified assessor is enlisted to thoroughly scrutinise and test the implemented controls. This higher level of assurance entails a comprehensive technical audit of the systems falling within the scope of Cyber Essentials. This includes a diverse selection of end-user devices, including BYODs (Bring Your Own Devices), all internet gateways and all servers with services accessible to unauthenticated internet users. The assessor conducts remote testing on a carefully chosen representative sample of these systems and will then make a decision on whether further testing is required.
How long is Cyber Essentials certification valid?
Cyber Essentials certification remains valid for 12 months and must be recertified annually. The assessment provides a 'snapshot' of your organisation’s cyber security, effective only on the assessment day. Given the ever-evolving threat landscape, organisations must commit to continuously maintaining the principles of the scheme.
Upon achieving Cyber Essentials certification, UK companies with an annual turnover of less than £20m are eligible for free cyber insurance.
For further information on Cyber Essentials, please visit the National Cyber Security Centre
Alarm Receiving Centres (ARCs) Applying to become ECHO-connected
Cyber Essentials certification is a pre-requisite for all ARCs wishing to become ECHO-connected., given they exchange data with police command and control systems.
ECHO is the not-for-profit organisation facilitating automated alarm signalling between ARCs and police control room, ensuring the secure and seamless quick exchange of data.
Cyber Security Product Assurance Group (CySPAG)
The Cyber Security Product Assurance Group (CySPAG) is a dedicated initiative set up by the British Security Industry Association with participation from industry representatives including NSI. Its origin stemmed from installers’ interest in securing their customers by assessing the security of cyber products and services. CySPAG is committed to providing assurance to consumers and businesses by rigorously assessing the cybersecurity capabilities of various products in the market.
CySPAG plays a pivotal role in enhancing cybersecurity standards and promoting trust in technology solutions by evaluating their resilience against cyber threats and vulnerabilities. Given the increasing use of internet connected devices and systems in electronic security, the growing number of links in home and business networks can leave individuals and companies vulnerable to cyber-attack.
What sets CySPAG apart is its supply chain-focused approach, encompassing both manufacturers and installers, each with separate codes of practice. These codes offer guidance on best practices.
The installers’ code of practice aids in fulfilling the duty of care to other network users, particularly concerning the safeguarding of existing cybersecurity measures and the implementation of new countermeasures. It provides recommendations on minimising exposure to digital sabotage of installed devices, applications and systems to protect the utilised network. This code emphasises guidance on the design, planning, operation, installation, commissioning and maintenance of installed devices, applications and systems with cyber exposure.