Standards and assurance
Cyber Essentials Plus is our baseline for technical defense
Cyber Essentials sets out the core controls every organisation should have in place. Cyber Essentials Plus goes further: an independent assessor tests those controls hands-on, to confirm they hold up against common internet-based attacks.
Laying the foundations for true supply chain trust
"Cyber Essentials presents an important opportunity to signal to customers, partners, and suppliers that cyber security is taken seriously. It helps organisations lay the foundations for true resilience."
- Andy Kays, CEO, Socura
The five technical controls of our assessment
A licensed external assessor carried out vulnerability scanning and hands-on testing of a sample of devices and user accounts across our organisation, to confirm we meet the five Cyber Essentials controls:
- Firewalls: Every in-scope device and network is protected by a correctly configured firewall, with default administrative passwords changed and any unnecessary inbound access blocked.
- Secure configuration: We remove unused software and accounts, change default credentials and apply secure settings to all devices and cloud services.
- Security update management: All operating systems, firmware and applications are licensed and supported, and high-risk and critical security updates are applied within 14 days of release.
- User access control: Access is granted by role and only as needed. Administrative privileges are kept to separate accounts, and multi-factor authentication (MFA) is enforced on our cloud services.
- Malware protection: All in-scope devices are protected against malware, which the assessor tests directly as part of the audit.
High-assurance validation for enterprise and public sector buyers
We work with public services, local councils and NHS trusts across the UK. Our Cyber Essentials Plus certification covers our whole organisation, not just a single site or team, and is renewed annually. It helps you complete supplier due diligence faster and supports the cyber security requirements in UK government procurement and NHS supply chains. Our security operations centre is also independently accredited by CREST, giving you assurance over the service that protects you as well as the systems behind it.
