CSA Cybersecurity Cyber Essentials mark Certification

• People – Equip employees with the know-how to be the first line of defence
• Hardware and software – Know what hardware and software the organisation has and protect them
• Data – Know what data the organisation has, where they are, and secure the data

• Virus/Malware Protection – Protect from malicious software like viruses and malware
• Access control – Control access to the organisation's data and services
• Secure configuration – Use secure settings for the organisation's hardware and software

• Software updates – Update software on devices and systems

• Back up essential data – Backup the organisation's essential data and store them offline

• Incident response – Be ready to detect, respond to, and recover from cyber incidents

The CSA Cyber Essentials mark is valid for two years upon successful completing the Cyber Essentials certification. 

Enterprises interested in CSA Cyber Essentials mark are required to submit relevant documents to TÜV SÜD PSB for verification and recommendation, based on the Cyber essentials requirements.

Companies should be familiar with the cyber essentials security controls and measures aligned with the Cyber Essentials mark’s requirements as per Q1. They are required to have relevant and quality documents to be submitted for the Cyber Essentials self-assessment to be reviewed.

Training is available for companies who are interested to learn more or to be certified for the Cyber Essentials mark. A discounted bundle deal is available for companies who are keen to train and certify with TÜV SÜD. Click here for more details.

The overall estimated timeline based on best scenario* for CSA Cyber Essentials mark is one month from the date of notice to the certification award. 

*Best scenario is when enterprises have proactively and timely submitted all the relevant documents from the 1st submission date without requiring additional time.

Yes, funding support is available for companies and the subsidy amount is determined by the profile of the companies which is shown as follows:

The following provisions safeguard the organisation from malicious software:

1. Equipping endpoints with anti-malware programmes to help identify attacks on the organisation's environment.
2. Using scanners for viruses and malware to look for potential cyberattacks.
3. Enabling automatic updates or setting up their anti-malware programme to automatically update signature files or something similar to find new malware.
4. Setting up anti-malware programmes to scan the files automatically.
5. Installing firewalls to secure networks that include computers, servers, and laptops.
6. Formatting a software firewall that leads to initiating the firewall for all endpoints in the organisation.
7. Verifying firewall configurations and rules once a year is crucial to safeguard the organisation's internet-facing assets.
8. Employees must install or access only authorised software and attachments from reputable or official sources.
9. Staff members must understand the importance of using secure network connections when accessing company data or official email.
10. Employees must immediately alert the IT team and/or senior management to any suspicious email or attachment.

Since cyber attackers use social engineering techniques to target employees for their motives, employees serve as the organisation's first layer of protection. A weak link in the staff is usually the culprit in security breaches. Therefore, all employees within the organisation must be appropriately trained to recognise these strategies, counteract them, and disclose any suspected incidents through the cyber essentials scheme.

The following provisions prepare you to identify, address, and recover from cybersecurity incidents:

1. The organisation must establish a basic incident response plan to serve as a roadmap for handling common cybersecurity incidents.
2. The organisation's employees with access to IT resources and/or environment must be aware of the incident response plan.
3. Strengthen and enhance the incident response plan. The organisation should conduct a post-incident review and incorporate learnings.
4. The incident response plan should be reviewed at least once a year as a good practice.

An end-point is a remote computing device that communicates back and forth with a network to which it is connected. Examples of end-points include: 

• Desktops 
• Laptops 
• Smartphones 
• Tablets 
• Servers 
• Workstations 
• Internet-of-things (IoT) devices 

The number of end points within your organisation is a cost parameter for this certification.