ISO 27001 and the Cyber Essentials Scheme

What is it?

The Cyber Essentials scheme identifies five fundamental technical security controls that organisations should implement to help defend against the vast majority of Internet-borne threats. It also provides a mechanism to demonstrate that these precautions have been taken.

The ISO/IEC 27000 set of standards have been developed to help keep information assets secure.

They help your organisation manage the security of assets such as financial information, intellectual property, employee details or information entrusted to you by third parties.

ISO/IEC 27001 is the best-known of these standards, detailing the requirements for an ISMS.

What does it protect?

Data and programs on networks, computers, servers and other elements of an IT infrastructure.

Information, regardless of where it is found (e.g. digital, hard copy, information systems).

Who can it help?

Organisations of all sizes that need to implement basic cyber security measures.

Organisations of any size and in any sector that need to keep information assets secure.

Structure

The Cyber Essentials scheme has only five controls: secure configuration, boundary firewalls and Internet gateways, access control, patch management and malware protection.

ISO 27001 has 10 clauses and 114 generic security controls grouped into 14 sections (called “Annex A”).

Implementation and certification

Cyber Essentials is a prerequisite for all suppliers bidding for UK government contracts that involve the handling of sensitive and/or personal information.

Some organisations choose to implement the Standard to benefit from the best practice it contains. Others achieve certification to reassure customers and clients that the Standard’s recommendations have been followed.