United Kingdom
Cyber Essentials and cyber insurance
In the United Kingdom the core list is Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection, cited by their CE codes. A control Cyber Essentials does not cover, such as backups, sits on the schedule as a condition beyond the core list.
The controls
- Every device sits behind a correctly configured boundary or host firewall, with inbound rules signed off and unused rules removed
- Staff sign in to email and the online services that hold business data (office suite, accounting, practice or client software) with multi-factor authentication
- Security patches for internet-facing services and devices (websites, remote access, firewalls, email gateways) are applied within the timeframes in the requirement
- Requests for privileged access are checked and signed off when first requested, and privileged accounts are tracked
- Every workstation and server runs centrally managed, behaviour-based anti-malware (often sold as endpoint detection and response)
- Operating systems, office software, browsers, PDF software and online services that the vendor no longer supports are replaced or removed
- Backups of data, applications and settings run on a schedule set by how critical each system is, and can be restored to a common point in time
Start from the template, or mark the controls in the control list. How the schedule works.
Questions
- Does this page say the business can be covered?
- No. It shows the gaps and the rule behind each; cover is the insurer's decision.
- What does it cost?
- One applicant on screen is free in any jurisdiction. Saving clocks and the applicant link are on Solo.