Cyber Essentials
Cyber Essentials is a UK government-backed scheme that helps protect organisations from cyberattacks and is required for government contracts.
Get in touchCroft partners with the UK’s leading Cyber Essentials certification provider to guide organisations through achieving Cyber Essentials or Cyber Essentials Plus compliance. We help businesses stay protected in today’s evolving cyber landscape by ensuring secure access, device safety, and employee awareness.
Croft is dedicated to safeguarding organisations and their employees’ devices. In today’s rapid and ever-changing cyber landscape, our mission is to enable organisations to protect themselves while educating their employees on existing and emerging cyber threats.
Recent and unforeseen events have altered the way we approach cyber security; with remote working rapidly becoming the norm, it has never been more crucial that your staff can access company systems and data securely from any device.
Cyber Essentials and Cyber Essentials Plus are UK government-backed certification schemes designed to help organisations protect themselves against common cyber threats.
By achieving Cyber Essentials, you are demonstrating that your organisation understands and has implemented fundamental cyber security controls.
Not only does it protect your business against cyber threats, but it also shows your customers, suppliers, and stakeholders that your organisation takes cyber security seriously.
Want to protect your business? Talk to one of our Cyber Essentials experts today!
You are currently viewing a placeholder content from HubSpot. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationBenefits of Cyber Essentials
Remove Complexity
Streamline the certification process to eliminate complexity. We will guide you through the entire journey from start to finish, providing all the guidance and recommendations to ensure you meet the requirements of Cyber Essentials.
Prepare Your Organisation
As part of the preparation phase, we utilise our smart agent software and cloud platform to analyse and check the compliance status of all end-user devices, including PCs, Macs, Apple, and Android mobile devices. This preparation will highlight any issues associated with your end-user devices.
Remediate and Resolve Device Issues
We will help remediate any non-compliant devices, including guiding end-users on actions they may need to take to achieve compliance. A detailed report will also be provided, outlining devices that fail due to outdated operating systems and our recommended solutions.
Assist with Self-assessment Questionnaire
Croft will assist you in completing the online self-assessment questionnaire using our smart digital portal. This intuitive portal captures and saves your progress, provides in-platform guidance, advanced security features, and unlimited support.
Questionnaire Remediation and Resolution Guidance
Croft will apply configuration changes and review data to support your Cyber Essentials assessment. The level of remediation depends on your IT environment and may require major updates like new security software. If so, we’ll discuss options with you and provide recommendations and cost details.
Submit Your Assessment for Review
Once we are satisfied that we can demonstrate the five security controls are in place, we will submit your assessment for review through the smart portal.
Complete Certification
The certification body will review the assessment questionnaire. If everything meets the standard, you will pass, and the certificate can be downloaded from the portal. If not, the assessor will provide feedback, and we can correct any issues and resubmit the assessment at no extra cost.
Cyber Essentials Certification
The Cyber Essentials certification is based on a self-assessment process. You will be required to complete a structured questionnaire that covers key aspects of your IT environment, including the scope of the assessment, employee roles, devices in use, and work locations.
The Cyber Essentials questionnaire will also evaluate your business’s implementation of the five core controls. Once this is completed, responses are formally approved by a senior executive, such as a board member. Your submission is then reviewed and assessed by an independent assessor.
1. Firewall
Use of a Firewall and appropriate controls to secure your internet connection.
2. Secure Configuration
Review endpoint and cloud settings to ensure alignment with best practices.
3. User Access Controls
Assess identity and access management in Microsoft 365.
4. Malware Protection
Evaluate the protection, deployment, and effectiveness across devices.
5. Security Update Management
Identify missing patches and unsupported systems.
Croft’s Cyber Essentials Certification Package Includes:
- 1 x Cyber Essentials Certification – to be achieved in any 12-month period
- Unlimited assessment submissions at no extra cost
- Assessment and Security Portal – secure cloud portal
- Smart Policies – policy templates for user distribution and agreement
- Active Protect – review of device configuration and security settings
- Croft Professional Services – step-by-step certification guidance and assistance
- Remediation Time – We have included an allocation of time to help remediate failed controls
Plus Cyber Insurance with £100k GBP Aggregate Limit
- Free when you achieve your Cyber Essentials Certificate
- Cyber insurance is designed to help you with robust coverage in the event of a cyber-attack
- 24/7/365 AIG response service
- Security and privacy liability
- Cyber extortion / Network interruption
- 48 hour free AIG First Response Service
Cyber Essentials Plus Certification
Cyber Essentials Plus builds on the foundations set by the standard Cyber Essentials certification by assessing your existing IT infrastructure. Your business must complete the initial Cyber Essentials self-assessment first before progressing to this level.
Although both certifications are based on the same core security controls, Cyber Essentials Plus provides a higher level of independent compliance assurance. During your technical audit, a qualified assessor will carry out a series of tests to ensure your security controls are in place and working effectively.
This assessment samples user devices, all internet-facing gateways, and any servers that provide services accessible from the internet, giving you a comprehensive evaluation of your cyber security posture.
1. Meet the Requirements of Cyber Essentials
Demonstrate that your organisation has implemented the five technical controls required for Cyber Essentials as set out above.
2. Independent Technical Audit
Unlike the basic Cyber Essentials, Cyber Essentials Plus includes a hands-on technical verification by a qualified assessor.
3. Vulnerability Scanning
Internal and external scans are conducted to identify unpatched software or misconfigurations.
4. Device Testing
Internal and external scans are conducted to identify unpatched software or misconfigurations.
5. Email and Web Browsing Tests
Simulated attacks are used to test defences against phishing and malicious websites.
Croft’s Cyber Essentials Plus Certification Package Includes:
- 1 x Cyber Essentials (CE) Certification – to be achieved in any 12-month period
- 1 x Cyber Essentials Plus Certification – to be achieved within 3 months of completing CE
- Independent assessment by expert auditors
- In-house vulnerability scanning to ensure all device checks are met
- Unlimited assessment submissions at no extra cost
- Assessment and Security Portal – secure cloud portal
- Smart Policies – policy templates for user distribution and agreement
- Active Protect – review of device configuration and security settings
- Croft Professional Services – step-by-step certification guidance and assistance
- Remediation Time – We have included an allocation of time to help remediate failed controls
Plus Cyber Insurance with £250k GBP Aggregate Limit
- Free when you achieve your Cyber Essentials Certificate. Cyber insurance is designed to help you with robust coverage in the event of a cyber-attack.
- 24/7/365 AIG response service
- Security and privacy liability
- Cyber extortion / Network interruption
- 48 hour free AIG First Response Service
Additional work completed for Cyber Essentials Plus
- Review all third-party software to check that it is up-to-date on all devices and servers
- Provide recommendations to remediate out-of-date software and vulnerabilities
- Remediation of out-of-date software and vulnerabilities using the available remediation time*
- Review and remove software that is not in use or not required (such as older versions of browsers)
- Confirm that all software, including Adobe, Java, Chrome, etc., is fully up-to-date on all devices and servers
- Schedule the 90-minute call with the auditor
- Install the Qualys agent provided by the auditor
- Attend 90-minute call with the auditor and the customer key contact
- Submit the assessment questionnaire to the certification body for review and evaluation
Additional Services
Excluded Services
The following services are not included as part of our Cyber Essentials packages:
- Hardware and software upgrades
- Any unexpected item not explicitly included in the service description
- Project work related to the implementation of additional IT systems and software
- Onsite visits, unless specifically detailed as part of your quotation
- Additional remediation time above the allocated amount in your quotation
Accreditations
Testimonials
What our clients say
You might also be interested in ...
IT Security Assessment
Find out moreSecurity Awareness Training
Find out moreDiscuss challenges. Get Solutions
Speak to one of our Cyber Essentials specialists about your technology challenges.
Get in touch
You are currently viewing a placeholder content from HubSpot. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information