risk management

Cyber Essentials, Cyber Essentials Plus and ISO 27001 are treated as three rungs on one ladder, and that is the first mistake. Two of them certify a fixed set of five technical controls; the third certifies the management system that decides which controls you need at all. This guide sets the three side by side on assessment method, cost, elapsed time, scope, renewal and buyer recognition. It walks through the five Cyber Essentials controls under version 3.3 of the Requirements for IT Infrastructure, the five test cases behind a Cyber Essentials Plus audit, and the mandatory clauses and 93 Annex A controls that ISO 27001 adds on top. It closes with a decision path based on who is actually asking, the evidence overlap if you end up holding both, and the sequencing that keeps the combined bill down.

Cyber Essentials failure is rarely caused by a sophisticated security gap. It is caused by an end-of-life laptop nobody logged, a cloud service quietly left outside the scope statement, or a director who has been reading email from an administrator account for four years. This guide works through the reasons organisations actually fail against version 3.3 of the Requirements for IT Infrastructure: scope boundaries that exclude what they cannot, unsupported software as an automatic fail, the 14-day patching deadline and its CVSS trigger, administrator account separation, mandatory MFA on cloud services, home working and BYOD traps, undocumented firewall rules, and the five Cyber Essentials Plus test cases where paper answers meet a live scan. It closes with a 60-day readiness plan and what to do inside the two-working-day correction window if a result has already come back non-compliant.