What’s New in Vanta 11.2.21

Choose the right Cyber Essentials certification. Although both versions of the Cyber Essentials frameworks have the same requirements, Cyber Essentials Plus involves a third-party audit and technical testing. As a result, Cyber Essentials Plus provides an extra layer of security validation beyond the self-assessment in the standard Cyber Essentials certification.

Determine your budget. Cyber Essentials Plus is more expensive than Cyber Essentials because of the external audit and higher security assurance. Pricing for Cyber Essentials ranges from £320 to £600 (plus VAT). Cyber Essentials Plus does not have a fixed pricing structure, but estimates start at £1,499 (plus VAT) and increase based on your organisation’s size and complexity. Learn more about Cyber Essentials costs.

Assess your time and team resources. Cyber Essentials Plus requires more time and bandwidth and takes longer to complete, especially for smaller companies (or security teams) with limited internal resources.

Understand your stakeholders’ concerns. The Cyber Essentials Plus third-party audit requirement enables you to demonstrate your commitment to enterprise-wide data security and assure stakeholders who may have security concerns.

Define customer requirements. Cyber Essentials Plus is required to win UK government contracts. It may also be required to conduct business with certain companies in the UK, such as those looking to prevent potential supply chain-related cyber threats from impacting their operations.

Evaluate your infrastructure size and complexity. Larger, more complex entities whose interconnected assets and operations are at high risk of being disrupted by cyber threats may benefit from Cyber Essentials Plus. Its rigour ensures reliable safeguards protect this infrastructure.

Estimate the volume and sensitivity of stored data. Companies that handle vast amounts of sensitive data (such as PHI in healthcare) may gain higher assurance with Cyber Essentials Plus.

Firewalls: All firewalls deployed to system boundaries, endpoints, servers, cloud services, and other critical infrastructure entry points should have the correct security configurations, access controls, and security rules.

Secure configurations: All configurations applied to endpoints and networked services should reduce exploitable vulnerabilities while enabling the completion of business-critical services.

User access controls: Access to all user accounts should require authorisation, and only the people who need access to specific endpoints, services, or applications to complete business tasks should have access. Consider using time-bound or just-in-time access and implementing the principle of least privilege (PoLP) to tighten user access controls.

Malware protection: Administrators should establish the appropriate security mechanisms to prevent malware intrusion via known and unknown sources. They should also educate employees and third parties on the risks of malware and ransomware and how to avoid social engineering scams.  

Security updates: All devices and software at risk for security flaws should be updated regularly to ensure their configurations are secure and in alignment with recommended industry/manufacturer security standards. 

Conduct a gap analysis. Evaluate IT infrastructure for gaps in the above control categories.

Document gaps and develop a remediation plan. Documenting the gaps identified and proposing actionable steps to rectify them is critical.

Test all applicable controls. It’s critical to monitor devices and networks to verify the effectiveness of implemented controls in preparation for assessment. Test your controls and make sure they are functioning properly.

Document findings from system monitoring. It’s also helpful to record all the information from monitoring in an organised, shareable report format to keep track of it. Doing so manually is a challenge for any organisation, which is where automation solutions, like Vanta, help reduce these burdens and enable organisations to scale their security monitoring capabilities as they grow.

Prepare for the Cyber Essentials self-assessment. Train all parties involved in the certification process so they are on the same page regarding Cyber Essentials documentation. Building and maintaining a security awareness culture is crucial for your organisation to fully comply with Cyber Essential security guidelines during its day-to-day operations beyond preparing for the Cyber Essentials self-assessment (or audit, if you choose to pursue Cyber Essentials Plus).

Conduct the self-assessment questionnaire. (SAQ). When ready, you can complete an online SAQ and have a senior team member validate it to get the Cyber Essentials certificate. It’s essential to be accurate and truthful when answering questions to ensure alignment with the necessary standards for obtaining the certificate.

Use online readiness tools to prepare for the test. Tools like the IASME Cyber Essentials Readiness Tool provide free questions to help you assess the posture of your company’s controls and their impact on your business operations. These questions are designed to inform you about your current readiness so you can develop a tailored action plan for the Cyber Essentials audit.

Decide whether you need the Cyber Essentials Plus audit. You can choose to obtain the Cyber Essentials Plus certification immediately after the Cyber Essentials self-assessment or in the following months. While you must complete just the self-assessment to obtain the Cyber Essentials certification, you’ll also need to complete and pass an external audit to receive the Cyber Essentials Plus certification.

Help your auditor understand your business. You will need to guide them through the ins and outs of your organization, including where your controls reside and which insights they provide to your business. They won't know where to start assessing your controls if they don’t understand your organization or GRC processes and tools.

Treat the audit like a conversation. In most cases, your auditor will be inside your organization for a few weeks to months, and during that time, it should become a back-and-forth working relationship. The auditor will likely ask you for specific evidence over time, and you will work with them directly to provide each piece of information they need, and so on.

Maintain the relationship with your auditor afterward. They can serve as a helpful resource as you build out your GRC initiatives and continuously maintain and improve compliance over time. While auditors can’t give direct advice on how to do something, most are more than willing to help wherever they can. For example, if you plan to change your tech stack, employee policies, etc., consider asking your auditor how these changes will impact future audits before committing to the change.

Track KPIs that show your response to the gaps that your auditor finds. The specifics of these KPIs will depend on your particular business, priorities, etc. In general, they should center around risk reduction and remediation efforts. For instance, if you have any findings, opportunities for improvement (OFI), or nonconformities listed in your report, track the response to these insights over time. How are you changing processes? What new tools have you implemented?

Consider conducting a readiness assessment between formal external audits. Businesses will typically either hire a third party or pick a team member who isn’t involved in any GRC activities to perform this type of audit. The best way to incorporate readiness assessments into your processes without causing business disruption is to use continuous monitoring to get an instant snapshot of all existing controls.

Treat your audit like a jumping-off point for security initiatives. Meeting a particular framework doesn’t necessarily equate to bulletproof security. For example, a compliance framework often doesn’t account for emerging threats. Still, consistently meeting the controls listed in a framework is a great starting point for establishing a strong security culture throughout your organization.

Foster a strong security culture. As you respond to your audit findings and implement stronger GRC controls, your team members need to understand why specific controls exist and how to play a role in meeting them. Ultimately, this is all about fostering a strong security and risk management culture throughout your organization. Consider rolling out security training and tracking KPIs such as phishing drill click-through rates and training completion rates. This will help demonstrate progress for future audits as well as improving your organization’s security posture.