Cyber Essentials 2026 – Lessons Learned From Actual Assessments

Before we dive into, you know, what we've learned over the three months, just to give everyone listening a bit of an overview of the cyber essential scheme itself, how it came about.

Yeah, so like it says there, the Cyber Essentials is a government-backed scheme.

NCSC state all the requirements, and it's run by IASME, who are the qualification body.

If you think of that as an umbrella, NCSC are very much at the top as the overarching organization.

They feed down to IASME, and then IASME feed down to certification bodies like URM.

So Jamie, when these requirements change, being pretty much annually.

So that doesn't come from us, that comes from the NCSC, IASMI, a combination of both?

Combination of both, yeah.

IASMI administer the scheme, but everything within the scheme has to be signed off by NCSC.

Okay, so as a certification body, we can't change the requirements? It's not up to us, we're

just here to... to check you're following the requirements, that's

it.

Okay, thank you.

Okay, and so the scheme covers five technical control areas.

At a bit of a high level, what control areas are they?

Starting off with firewalls.

This is just to ensure that all devices are running firewalls and act as a first kind of line of defence against potential threats.

Secure configuration, making sure your devices are configured correctly.

And again, like it says, minimizing the attack surface.

So you're not leaving ports open on your firewall.

You've configured it correctly, that kind of thing.

And the same for user access control.

Again, if you're just spinning up accounts and giving them to anybody, then it increases your attack surface.

You want to be managing your who can access your organizational data.

And that's what user access control is.