What are the five foundational security controls of Cyber Essentials?

by | Dec 2, 2024 | Articles

Cyber Essentials is a UK government-backed scheme that helps organisations protect themselves from common cyber threats. It outlines five fundamental security controls businesses should implement to safeguard their systems and data. Adopting these measures allows a company to defend against approximately 80% of typical cyber threats. The five controls are as follows:

1. Firewalls and Internet Gateways: This control ensures that properly configured firewalls protect all devices connecting to the internet. Firewalls act as barriers between internal networks and external threats, blocking unauthorised access while allowing legitimate communication. To implement this control, businesses should ensure that all internet-facing devices, such as routers and gateways, are equipped with up-to-date firewalls and are configured to block malicious traffic.

2. Secure Configuration: A secure configuration involves setting up devices, systems, and software to minimise vulnerabilities. This means removing unnecessary software, closing unused ports, and applying the principle of least privilege. To effectively implement this control, businesses should regularly review and update system configurations, ensure that only necessary services are running, and keep systems patched to address security flaws.

3. User Access Control: This control ensures that only authorised users can access specific systems or data. It involves managing user permissions and restricting access based on roles while employing robust authentication mechanisms. To implement this control, businesses should use unique user IDs, enforce strong passwords, and utilise multi-factor authentication (MFA) wherever possible to enhance access security.

4. Malware Protection: This control protects systems from malware, including viruses, spyware, and ransomware. This involves installing and maintaining anti-malware software and regularly updating it to detect the latest threats. Organisations must also monitor their systems for signs of malware and act swiftly if an infection is detected.

5. Patch Management: This control keeps software and systems updated with the latest security patches and updates. Cybercriminals often exploit vulnerabilities in outdated software, making it essential to apply patches regularly to reduce the risk of attacks. Businesses should establish a patch management process to ensure that all software, including operating systems and applications, is patched promptly.

Together, these five security controls form the foundation of a robust cybersecurity strategy. By implementing them, organisations can significantly reduce their exposure to common cyber threats and demonstrate a commitment to protecting their data and systems.

A great way of starting your journey is to consider Cybersmart and its suite of products to help you manage the process of attaining your cyber security objectives.

Ready to start your Cyber Essentials certification process? Speak to Business Defence Systems today!