U.K. Cyber Essentials Simple Assessment Tool

I recently came across the U.K.’s Cyber Essentials, as published by the National Cyber Security Centre (NCSC). Not two days after I learned about this simple control framework while on a conference call spanning several time zones with friends from around the world, that I received this email from a fan in my inbox:

Alex, I really enjoyed your recent assessment tool for the CIS Controls, and your publication on the Australian Essential Eight! Have you ever looked at the Cyber Essentials from the U.K.? We reference it here across the pond for consulting with small business customers… [abbreviated for length] …but would you consider adapting your CIS assessment tool for use with the Cyber Essentials? –James

When the universe puts something at my feet twice in one week, that’s enough for me to act on it. So this weekend I threw this thing together, following the documentation available at NCSC’s website, where they describe the technical requirements (i.e. sub-controls) for each of the five Essentials:

1. Use a firewall to secure your internet connection
2. Choose the most secure settings for your devices and software
3. Control who has access to your data and services
4. Protect yourself from viruses and other malware
5. Keep your devices and software up to date

Now the very interesting thing about this framework is that, at the present time, it does not consider cloud-hosted SaaS applications as “in scope.”

This would seem to exclude Microsoft 365, however, I would suggest that any person following this assessment in the U.K. or elsewhere would be a fool not to apply at least some aspects to Microsoft 365 where relevant, for example the requirement to protect accounts with 2FA where possible, or to document who has access to your systems. As well, remember that you can leverage services such as Microsoft Endpoint Manager (Intune) to apply secure configurations to devices and applications–which would help you to meet some of the other items here.

So yes, this framework appears to be ready for an update–for example the fact that firewalls hold such a prominent position on this list, in this day and age, seems quaint, and there is much that could be said about securing your SaaS products, especially with regards to identity! Nevertheless and criticisms aside, there is some common overlap between all of these frameworks. Yes–the CIS is definitely the more “complete” framework, but really important stuff like patching, the principle of least privilege, whitelisting and multi-factor always make the list.

I am not sure what James meant by ‘adapt my CIS assessment tool‘–so I just created a new workbook in the same style as the first! I also included a column for Mapping to CIS Controls as a reference.

Click here to download your free copy of the U.K. Cyber Essentials tool

Update: I just learned from another reader, about another miniature framework that is used by the U.K. government that is a bit broader and contains some really good stuff in 10 major controls, which are broken into groups by NIST CSF function (Identify, Protect, Detect, Respond and Recover). It is called the Minimum Cyber Security Standard. I like this a lot more than the Cyber Essentials, which as I mentioned feel a bit dated. I may even work on updating this spreadsheet so that it contains tabs for both. Thanks, Vinny!