Tag: cybersecurity

Cyber Essentials vs ISO 27001

What is the difference between Cyber Essentials vs ISO 27001?

We often get asked by companies looking to strengthen their cybersecurity which is the better option Cyber Essentials vs ISO 27001. Here at The Unite Group we always stress how different the two schemes are and that they should not be compared but instead accepted as two very different schemes which both enhance a company’s security stance.

In this article, we discuss the two schemes and offer further information for any business looking to improve its cybersecurity.

Cyber Essentials

What is it?

The Cyber Essentials scheme is a Government backed scheme that covers 5 key areas of cybersecurity; access control, software updates, firewalls & routers, secure configuration & malware protection. The aim of this scheme is to protect against the most common forms of cyber-attacks. This certification is also required to bid for Government contracts.

What does it aim to protect?

By completing the Cyber Essentials certificate, your organisation is effectively protecting itself against approximately 80% of the most common cyber-attacks. This is because this scheme protects your data and programs on hardware such as computers, networks, servers and any other elements in your IT infrastructure.

Who should consider being a part of the Cyber Essentials scheme?

All organisations who want to protect their businesses should partake in the scheme. Not only does it protect your business. But it also demonstrates to your clients that they can be confident their data will be in safe hands. Therefore any business that is looking to implement basic cybersecurity measures should look into achieving the certification.

Also, for any businesses that wishes to bid for Government contracts this certification is a prerequisite. Therefore, if you wish for your business to be considered for such opportunities you should begin the process of achieving this as soon as possible.

ISO 27001

What is it?

ISO 27001 is a set of standards that have been designed to keep information assets secure. This certification allows you to manage the security of assets including financial information, intellectual property, employee details and any information entrusted to you from third parties. ISO 27001, therefore, has more elements within its scope. ISO 27001 has 10 clauses and 114 generic security controls grouped into 14 sections

What does it aim to protect?

ISO 27001 differs from Cyber Essentials as it aims to protect all information and data regardless of where it is found. Meaning the certification covers hard copies, digital & data stored within information systems.

Who should consider achieving ISO 27001?

Similarly to Cyber Essentials, any business that wishes to demonstrate that they take data protection seriously should work towards achieving the certification. Some organisations sometimes choose to implement the standard to ensure they are following recommended guidelines. Others however choose to complete the certification to reassure their customer’s and client’s.

So, is Cyber Essentials the same as ISO 27001?

In short, no. However, the two complement one another.

We recommend anyone without both a Cyber Essentials certification and ISO 27001 consider achieving both certifications at the same time. In terms of time & money, this proves to be the most effective.

However, if this is not an option, we suggest you opt for achieving Cyber Essentials first. This scheme follows a simpler process and will introduce you to the world of certification and data protection.

How can we help?

Here at The Unite Group, we are certified Cyber Essentials assessors. Therefore, we can guide you throughout the process as well as assess your application for certification. Our friendly team is on hand to assist throughout the self-assessment questionnaire.

Want to learn more? Book an appointment with our Cybersecurity team today!

November 8, 2022
What is the difference between Cyber Essentials & Cyber Essentials Plus?

Are you interested in achieving a Cyber Essentials certification but unsure as to what level of certification is best for you? In this blog, we break down the main differences between Cyber Essentials & Cyber Essentials Plus. As well as offer recommendations for which level of certification businesses should consider.

Let’s recap what Cyber Essentials is

As mentioned in our previous blogs, Cyber Essentials is a government-backed scheme aimed to protect businesses from 80% of the most common cyberattacks. There are 2 levels of certification that we will discuss later; Cyber Essentials & Cyber Essentials Plus. Certification must be renewed annually and cover 5 main areas of checks. Businesses who have a Cyber Essentials certification not only can be assured they comply with the latest cybersecurity measures but also have a clearer picture of their company’s cyber security level.

So, what is Cyber Essentials?

This is the basic level of certification. Achieving Cyber Essentials involves the completion of a self-assessment questionnaire. This questionnaire involves 8 sections and has a total of 70 questions. Here at The Unite Group, we can provide support before taking the assessment to ensure all expected standards are met. As well as providing assistance throughout the application. Upon completion, the business owner or board-level representative must then sign a declaration that all answers are completed correctly. This is then reviewed by a Cyber Essentials assessor and successful applicants will receive their certification.

Who do we recommend Cyber Essentials to?

We recommend the Cyber Essentials certification to all businesses who want to demonstrate that they take cybersecurity seriously. Having this certification can also open new doors for business opportunities as it is a requirement to bid for Government contracts. We recommend this to smaller corporations that want to ensure they are complying with recommended safety measures.

Now let’s compare this with Cyber Essentials Plus

The Cyber Essentials Plus certification involves the same first steps as the Cyber Essentials scheme. Therefore, meaning they both include the completion of the self-assessment questionnaire. However, Cyber Essentials Plus then goes on to further include a vulnerabilities assessment and an on-site assessment. The assessment covers the controls your organisation has in place. As well as, your employee’s work-from-home locations. Also assessing any third parties who may have access to your premises or IT infrastructure. These assessments are undertaken by a trained and qualified Cyber Essentials Plus assessor.

Who do we recommend the Cyber Essentials Plus scheme to?

Here at The Unite Group, we recommend this scheme to those businesses that want to demonstrate higher levels of cybersecurity protection. Whilst Cyber Essentials is a great starting point, the added levels of assessment included in this scheme increase a business’s protection far more. Those who hold a Cyber Essentials Plus certification can bid for Ministry of Defence contracts.

Recap

To recap, the main difference between the two schemes is that the Cyber Essentials Plus certification covers more areas of assessment. It includes a more rigorous test of an organisation’s cybersecurity systems. Experts carry out vulnerability tests and as a result, ensure organisations are well protected against basic hacking and phishing attacks. Therefore, we strongly recommend this option to businesses who want to ensure they best protect their data and that of their customers.

Let us help!

Here at The Unite Group, we can guide you through Cyber Essentials and help you protect your business. We have in-house Cyber Essentials assessors to not only approve certifications but also provide support throughout the application process. We are a friendly voice on the other end of the phone to support you through the certification from start to end.

To find out more, book a quick call with our team today!

October 14, 2022
How can Cyber Essentials help protect your business?

In short Cyber Essentials helps protect your business by protecting you from the most commonly known cyber-attacks. No business owner wants their company to be at risk of any complications which could compromise their ability to operate. In terms of cyber security, we highly recommend companies take the necessary actions to best protect themselves. This is why we encourage achieving a Cyber Essentials certificate.

Let’s break down the 5 main areas of the certification and how Cyber Essentials helps protect your business.

1.      Access Control

Cyber Essentials covers who has access to your files. This is something businesses often overlook. It is important to consider who has access to what. Do all your staff really need access to all your files? Having managed access to administrator accounts means you can protect who has access to your data and services.

2.      Software Updates

The Cyber Essentials scheme also ensures all devices are kept up to date with software updates. Staying current with the latest software updates and security patches protects you against the newest cyber-attacks and vulnerabilities. Updates not only add new features they also are designed to tackle the latest threats on software. To pass the certification all devices must be kept on the latest updates.

3.      Firewalls & Routers

Firewalls are designed to protect businesses from users who are not authorised from gaining access. So by having a firewall in place, you create a so-called ‘buffer zone between your IT network and any other external links. This will allow you to analyse any incoming traffic. Meaning you can decide who to allow access to on your network. Therefore protecting your business from hackers.

4.      Secure Configuration

Secure configuration covers ensuring you choose the most secure setting for your devices and software. This includes changing passwords regularly as well as removing unused accounts and software. It is easy to forget to remove any unused users and software. However, it is very important! Taking such measures massively reduces the risk of potential cyber-attacks. Therefore, protecting you and your data from being compromised.

5.      Malware Protection

Malware protection is another key part of the Cyber Essentials scheme. Using properly configured anti-malware software will protect you from viruses and other malware risks. Anti-malware software will only allow trusted applications to run which reduces the risk of unsafe applications running in the background without you knowing.

Why is protecting your business so important?

Figures from 2021, show 39% of businesses identified a cyber-attack on their business. Of the 39%, 1 in 5 identified a more sophisticated attack type such as a denial of service, malware, or ransomware attack. With 31% of those businesses estimating they were attacked at least once a week. Overall averaging at a cost of £4,200 for small businesses rising to £19,400 for medium and large businesses. Could your business afford such a loss?

Of course, we should also consider not only the financial impact such attacks can have. But also the damage it can do to customers’ trust in your business. As well as the likelihood of them being a returning customer. Would you trust a business if you knew they had gaps in their cyber security which meant they had fell victim to an attack?

No measures can completely eliminate the risk. However, achieving a cyber essentials certification reduces the risk by at least 80%!

Let us help!

Here at The Unite Group, we can guide you through Cyber Essentials and help you protect your business. We have in-house Cyber Essentials assessors to not only approve certifications but also provide support throughout the application process. To find out more, book a quick call with our team today!

October 10, 2022
Cybersecurity – 5 reasons why your business should outsource it

Cybersecurity with The Unite Group

Maintaining a strong cybersecurity posture is a significant challenge for most businesses. With complex cyberattacks becoming more common, all businesses are at risk of falling victim. To reduce this risk, businesses typically implement new technologies that focus on prevention, detection, and remediation.

However, this technology alone will not prevent a cyberattack, it will need to be supported by skilled security professionals. Many businesses choose to outsource this to a trusted third party to ensure their business is as safe as possible. In this article, we will discuss 5 reasons why businesses should outsource their cybersecurity.

Access to experienced professionals

Many businesses rely on their in-house IT teams to manage their infrastructure, as well as their cybersecurity. Depending on the size of the company, and the workload of the IT department, this can be an overwhelming task. This can then result in a poor security posture and an overworked team. This is made harder as there is a cybersecurity skills shortage. This makes it difficult for businesses to employ experienced cybersecurity professionals.

When a business outsources their cybersecurity to a trusted third party, they gain access to a team of cybersecurity specialists. Their experience ensures they will be able accurately find and plug gaps within a business’s security posture. And most importantly they are aware of the current cyberthreats, and the best way to avoid them.

Reduce costs

For businesses of all sizes, employing a new security professional or training an existing employee can be extremely expensive. For smaller businesses, it can sometimes be difficult to justify having an employee that is dedicated solely to security. In addition to the cost of employing or training someone, a business will still need to pay for cybersecurity technologies.

Whereas if a business outsources its cybersecurity, the cost is typically a fixed amount per month. This includes the technology, as well as access to the team of cybersecurity professionals. Whenever a business is considering the cost of outsourcing security, they should also consider the average cost of a cyberattack. Looking at the cost to the business if this was to happen can help estimate the return on investment.

Decrease workload for in-house IT teams

If your business has an in-house IT department, it is highly likely they already have a full workload maintaining the IT and assisting with support requests. This often leaves them with insufficient time to work on the perfect security solution, or threat monitoring.

With outsourced cybersecurity, the third-party provider is responsible for the planning, implementation and monitoring of a cybersecurity solution. This gives in-house IT departments more time to spend providing IT systems that help grow the business and provide better experiences for other employees and customers.

Improved incident response time

After a business falls victim to an attack, it is imperative that they respond quickly to reduce further damage and limit downtime. If a cybercriminal enters a network or system during the weekend, an in-house IT team may not notice until Monday morning. This will give the threat actor enough time to move laterally across a network and inflict even more damage. For example, it only takes 18 minutes for Russian nation-state hackers to move across a network.

Many cybersecurity providers offer 24/7 protection, detection and remediation to ensure that regardless of when an attack occurs, there is someone ready to swiftly take action. This is also a more cost-effective method of around the clock protection, as it would be extremely expensive to hire an internal team to work throughout the nights and on weekends.

Access to advanced technologies

There are many cybersecurity technologies out there which are designed to fulfil specific roles, including endpoint protection, email protection, autonomous detection, and many more. For an in-house IT department, they will not have experience with all of these advanced technologies, and it would be too costly and time-consuming to provide training for all solutions.

If a business chooses to outsources their cybersecurity requirements, they will be protected by a team of professionals that have experience in the cybersecurity technology. As this team live and breathes cybersecurity, they will also be able to accurately provide insights into which technologies are worth a business investing in.

Looking to outsource your cybersecurity?

In 2022, all businesses need to invest in cybersecurity, before it is too late. There are many advanced threats out there that most in-house IT departments are not prepared or able to defend against. For this reason, it is logical for businesses to outsource their cybersecurity to a trusted third-party provider. To find out more about how we can keep your business safe, contact us today.

July 21, 2022