Businesses today are facing a growing range of cyber threats, from phishing attacks to session hijacking and increased use of social engineering tactics. Fortunately, the UK’s Cyber Essentials standard provides a clear framework for improving your cybersecurity and protecting your business.

1. Install and Regularly Update Antivirus and Anti-Malware Software

Effective antivirus and anti-malware solutions are essential defences against cyber threats. Not the old traditional kind but the latest next-gen products like SentinelOne as an example. Cyber Essentials recommends that all business devices—whether desktops, laptops, tablets, or phones—are protected by quality, up-to-date anti-malware software.

Quick Tip: Set up automatic scans and real-time protection to catch threats as they arise. Ensure updates are set to run automatically, so your protection stays current.

2. Use Strong, Unique Passwords and Enforce Multi-Factor Authentication (MFA)

Passwords are a key security element under Cyber Essentials. Implement strong, unique passwords for each account, or even better use Passkeys where possible. Enforce Multi-Factor Authentication (MFA) wherever possible, particularly for sensitive applications and systems.

Quick Tip: A good password manager can simplify managing unique passwords. Make MFA a requirement for remote access to your network and any cloud services.

3. Control Access to Data and Limit Permissions

Cyber Essentials emphasises restricting access to data based on job roles and responsibilities. Implement access controls to ensure that employees only have access to the information necessary for their work, reducing the risk of accidental or intentional data leaks.

Quick Tip: Use role-based access controls to grant permissions, and regularly review user access to ensure that permissions are up-to-date and relevant.

4. Patch and Update Software Regularly

Keeping software up to date is critical for cybersecurity, as lots of updates include important security patches to remediate vulnerabilities. Cyber Essentials requires prompt application of patches and updates to address vulnerabilities, especially for operating systems, anti-malware, and applications used for work.

Quick Tip: Configure software to update automatically. Review systems weekly to ensure that no critical updates are missed.

5. Use Firewalls to Protect Your Network

Firewalls are a key Cyber Essentials recommendation for managing and filtering traffic into and out of your network. Properly configured firewalls (including software firewalls) create a security boundary that protects your internal systems from external threats.

Quick Tip: Invest in a business-grade firewall solution, and regularly review firewall settings to make sure they reflect the latest security requirements.

6. Secure Configuration of Devices and Software

Cyber Essentials stresses the importance of setting up devices and software securely. Ensure all systems are configured with security settings in mind, disabling unused accounts, removing unnecessary software, and avoiding default configurations that can create vulnerabilities.

Quick Tip: Review system configurations upon installation and regularly thereafter, especially for new devices. Consider setting up templates for secure configuration.

7. Manage and Monitor User Access

In line with Cyber Essentials, limit admin access to essential personnel only, and monitor access logs for unusual activity, and keep admin use for admin tasks only. Reducing the number of admin-level users decreases the likelihood of a breach with widespread access.

Quick Tip: Use separate accounts for admin tasks and day-to-day activities. Restrict admin access, especially for sensitive systems.

8. Secure Wireless Networks

Unsecured Wi-Fi networks are easy entry points for cyber attackers. Ensure your business network has a secure configuration, including strong passwords and encryption, to meet Cyber Essentials standards.

Quick Tip: Set up a separate network for guests if necessary and avoid using default Wi-Fi credentials provided by your internet service provider.

9. Create a Backup Plan and Test It Regularly

Although Cyber Essentials does not directly cover backup practices, creating a backup plan is critical for data recovery and business continuity. Regularly back up important data to a secure location, separate from your primary network. If you use Microsoft 365, remember it is not backed up, so you’ll need a good 3^rd party backup solution in place.

Quick Tip: Automate regular backups to the cloud or an external drive, and periodically test restoration to ensure your data can be recovered if needed. Get a backup service in place for Microsoft accounts.

10. Educate Employees on Cyber Security Awareness

Human error is one of the leading causes of security breaches. Cyber Essentials emphasises the importance of training employees to recognise and avoid cyber threats like phishing and social engineering attacks.

Quick Tip: Conduct ongoing cybersecurity training and practice drills. Educate your team on identifying and reporting suspicious emails or activity.

Let’s Summarise

Cyber Essentials provides a practical, straightforward approach to business cybersecurity. By following these ten principles and technical controls, you can create a resilient defence against cyber threats. Achieving Cyber Essentials certification can also enhance customer trust, as it demonstrates your commitment to safeguarding data and maintaining a secure business environment. Embrace these essentials today and protect your business for a more secure future. Cloud4 is a Cyber Essentials Certification Body, and our team can help you achieve this important standard wherever you are starting from.