Cyber Essentials

Cyber Essentials

Cyber Essentials is a UK Government-backed certification that demonstrates your organisation’s commitment to cybersecurity. It establishes a strong security baseline by focusing on five key controls: firewalls, secure configuration, user access control, malware protection, and patch management.

Achieving Cyber Essentials certification can boost your organisation’s reputation and reassure customers that you take cyber threats seriously. It’s also a requirement for certain government contracts.

How OGEL Can Help Your Organisation

Helping you obtain Cyber Essentials/Cyber Essentials Plus certification

OGEL IT hold Cyber Essentials certification for our own systems and services and are therefore familiar with the various controls. We can help ensure organisations have appropriate technologies and services in place to be able to meet the controls giving them the confidence to be able to complete a self-assessment (Cyber Essentials) or engage an NSCS assured organisation for an external assessment (Cyber Essentials Plus).

We provide a free security health check for your organisation, helping to identifying areas that require attention. There are no obligations, and we collaborate with you to address any issues, establishing a robust security baseline.

Register Your Interest in Cyber Essentials

Cyber Essentials

Key benefits to your organisation

Increased Security
Cyber Essentials certification provides peace of mind that you have a strong security baseline.
Greater Reassurance
Reassure your customers by showing a commitment to cyber security.
Attract New Business
Stand out as an organisation with industry recognised IT security certification.
Cyber Insurance
Another benefit of Cyber Essentials is that it includes free cyber insurance for UK-based organisations that certify as a whole organisation (additional terms and conditions apply).

Cyber Essentials Managed Services

Our managed services are designed to meet and exceed the requirements for Cyber Essentials certification. We collaborate closely with our customers to support and maintain this certification; this includes the remediation of any issues if required.

Below are our five security controls that we use to assist your organisation.

Firewalls
As part of our managed end-user compute service we configure and manage the native operating system firewall to ensure rules are in place to only allow the specific ports and services that are required, for both inbound and outbound traffic. We can also help with the implementation and configuration of additional endpoint protection software that adds an additional application firewall when working on and off-net.
Furthermore, we can implement, configure and manage physical perimeter firewalls to provide an additional layer of security based on your organisations requirements.
Secure Configuration
Our end-user compute deployments prioritise security by implementing hardware-backed full-device encryption to safeguard data at rest. Additionally, we enforce robust and unique elevated account passwords on all devices, while deactivating default administrator accounts for enhanced protection. Our comprehensive approach to account security includes passwords, biometrics, multifactor authentication, and pre-boot PIN requirements.
Furthermore, we diligently manage applications, promptly removing end-of-service applications to mitigate vulnerabilities. Additionally, all our builds adhere to policies aligned with Microsoft, Cyber Essentials, and National Cyber Security Centre (NCSC) guidelines.
User Access Control
We engage in collaborative efforts with our customers to consistently implement and review role-based access controls. Leveraging Azure identity management, multi-factor authentication (MFA), and privileged access reviews, we maintain a secure privileged access model. Our approach adheres to the principle of least privilege, where we create custom roles when existing ones grant excessive access. Additionally, we ensure that access is granted only for the necessary duration.
Furthermore, our managed services capitalise on Entra ID Premium features, including Azure Identity Protection, protection against weak or compromised passwords, and risk-based conditional access policies.

Malware Protection
Our end-user device deployments leverage the advanced security features within Microsoft’s Defender for Endpoint, including next-generation antimalware and endpoint firewall.
We configure automatic alerting through our service desk to promptly notify us when a threat is detected. These threats are then promptly blocked and appropriately quarantined. Additionally, we enforce web control and URL blocking to safeguard against harmful websites, and application control to prevent and report on unwanted application behavior.
Furthermore, we establish a robust security baseline within Microsoft 365, incorporating anti-malware, anti-spam, anti-spoofing, connection filtering in addition to many other security measures.
Patch Management
As part of our managed services, we maintain continuous monitoring for known vulnerabilities. To uphold our customers’ certification, we promptly patch all critical and high-severity vulnerabilities within 14 days of their release. Additionally, we implement automated monthly patching processes for both end-user devices, mobile devices, and servers.
Our team provides detailed reports on patch compliance and runs regular Nessus vulnerability scans to provide a clear view of the current state of all computers, offering peace of mind that no vulnerabilities have been overlooked.

OGEL do not provide Cyber Essentials Assessments or provide NSCS assured Cyber Advisors we provide technology or access to technical resources to configure systems to meet the required Cyber Essentials controls.