Cyber Essentials: Boon or Burden for Businesses?

More and more companies are aiming to get Cyber Essentials certified, as it’s now required by the NHS and UK Government for their suppliers. The benefits are clear: better security, free cyber insurance, and access to government and NHS contracts, but are there any Cyber Essentials certification risks?

Cyber Essentials allows companies to assess themselves, offering a chance to tighten their cybersecurity before certification. However, this flexibility also opens the door for shortcuts. While such cases are rare, they raise concerns.

Cyber Essentials Insurance: False Claims, Real Consequences

Businesses below £20 million in annual income can opt-in to receive free Cyber Essentials insurance when they meet the program’s security standards. But be warned: this insurance only covers attacks that bypass properly implemented controls. If you claim to have upgraded your security but haven’t done it, you’ll be on the hook for the full cost of the attack, including fines and lawsuits. The insurance company will investigate and deny coverage if they find you lied about your controls. Play it safe by genuinely improving your security – it’s your best defence against cyber attacks and financial ruin.

Cyber insurance providers often recommend Cyber Essentials, as it strengthens a company’s defences, reducing their risk and the insurer’s potential payouts. It’s a win-win. But obtaining the certificate through dishonest means can jeopardise the very insurance it unlocks.

Protecting Yourself: Avoiding Inaccurate Submissions

Businesses often rely on IT service providers for Cyber Essentials certification. However, unintentional errors due to provider unfamiliarity with the scheme can occur. How can businesses prevent this?

The most important step in preventing a false cyber essentials submission, is to review your answers before they’re submitted. In every assessment, a board level director or person of senior position is required to approve the question set. This is known as the declaration and is the final step in any Cyber Essentials project. Once all other questions are answered, the appropriate board executive is required to sign the declaration to confirm that all questions have been answered accurately. At this stage of the submission, to knowingly submit incorrect information and reap the benefits is paramount to fraud.

Cyber Essentials: Embrace the Journey, Reap the Rewards

Cyber Essentials is a great tool for protecting your business against common cyber attacks that target small and medium-sized companies. But remember, the real benefits come when you put in the effort to improve your security practices. Once committed, the Cyber Essentials scheme can improve processes and cyber security controls, while allowing your business to thrive.

Finally, as a business owner, you can be comforted by the fact that if an incident does occur, the Cyber Essentials insurance will get you back on your feet!