Research of Compliance With Cyber Essentials Requirements for Company’s Certification

This paper examines the Cyber Essentials requirements for ensuring basic security controls, which need to be implemented to protect against the most common cyber threats. Cyber Essentials is a foundational cybersecurity certification scheme developed by the UK government, which has been in operation since 2014 and under which more than 100,000 organizations have been certified. Unlike the international standard ISO 27001:2022, which implements a comprehensive approach to building an information security management system, Cyber Essentials is a basic level of protection against cyber threats, which is built based on five core controls.
This work analyzes the use of Cyber Essentials controls such as firewalls, secure system configuration, patch management, user access control, and malware protection. Implementation of these controls can significantly reduce the risk of cyberattacks and maintain data confidentiality.
This paper compares the two levels of Cyber Essentials certification: Cyber Essentials, which is based on an organization’s self-assessment, and Cyber Essentials Plus, which includes a technical audit of the IT infrastructure to verify compliance with security requirements. Both certification levels require an independent assessment to ensure objectivity and impartiality in the certification process, as well as to increase confidence in the obtained certificate.