Cyber Essentials: Readiness Without Treating it as a Certificate

The Context

The UK Government's Cyber Essentials (CE) scheme provides a solid baseline for defending against the most common cyber threats. Many schools and Trusts are now required to hold this certification for funding or compliance reasons. However, schools often treat CE as a one-off exam to be crammed for, rather than a continuous operational standard.

Who This Guide is For

IT managers, school business leaders, and MAT executives.

Why This Matters

If a school implements a strict firewall rule to pass the CE audit on Tuesday, but disables it on Thursday because a teacher complained they couldn't access a website, the school is no longer secure. A certificate on the wall will not stop a ransomware attack if the underlying controls have degraded.

What Good Looks Like

Cyber Essentials is treated as 'business as usual'. The five core technical controls (firewalls, secure configuration, user access control, malware protection, and patch management) are actively monitored and enforced year-round, making the annual certification a simple formality rather than a massive remediation project.

Approach and Methodology

1. Understand the Five Controls: Ensure the IT team and leadership fully understand the strict requirements of the five CE pillars, particularly around patch management (critical updates applied within 14 days).
2. Continuous Monitoring: Deploy tools (like MDM or RMM) that continuously report on compliance. If a device falls out of compliance (e.g., the antivirus is disabled), it should be automatically flagged or quarantined.
3. Automate Patching: Do not rely on manual patching. Automate the deployment of OS and third-party application updates across all endpoints and servers.
4. Scope Control: Clearly define the scope of the CE assessment. Are guest Wi-Fi networks included? Are student BYOD devices included? Segregate networks physically or logically to manage the scope effectively.
5. Enforce the Baseline: If a user requests software that violates the secure configuration baseline (e.g., requiring outdated Java), the request must be denied, or an explicit, board-approved exception must be documented.
6. Pre-Audit Health Check: Conduct a mock assessment two months before the certification renewal date to identify any configuration drift.

Evidence to Retain

• The current Cyber Essentials or Cyber Essentials Plus certificate and the accompanying assessment report.
• Monthly automated reports showing device patch compliance levels (e.g., 95% of devices patched within 14 days).
• Documented network diagrams showing the segregation of the assessed network.

Questions Leadership Should Ask

• "If we were audited for Cyber Essentials today, unannounced, would we pass?"
• "Do we have a system that alerts us immediately if a critical security patch fails to install on our servers?"

Common Pitfalls

• The "Tick Box" Mentality: Answering "Yes" on the self-assessment questionnaire based on a policy document, without verifying the technical reality.
• Ignoring Third-Party Apps: Updating Windows diligently, but failing to patch vulnerable third-party applications like Adobe Reader or Google Chrome.
• Scope Creep: Failing to properly segregate the network, meaning every unmanaged student mobile phone on the guest Wi-Fi suddenly falls into the scope of the audit.

How asitplan Can Help

asitplan enables schools to map their active network data against the specific requirements of the Cyber Essentials framework. By highlighting gaps in patching, unsupported operating systems, and misconfigured firewalls, schools can maintain a continuous state of readiness.