Praesto Group has achieved two cyber security certifications in a single assessment: Cyber Essentials and the IASME Governance Standard, including its assessment against the GDPR. Both cover the whole company: Praesto Consulting Group and its subsidiaries.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed scheme, supported by the National Cyber Security Centre (NCSC). It sets out the controls every organisation should have in place against the most common cyber attacks, such as phishing, malware and password guessing. It covers five areas:
- firewalls
- secure configuration
- user access control
- malware protection
- keeping software up to date
For readers outside the UK, think of it as the government’s own baseline for good cyber security. It is required for many UK government contracts, and more and more private-sector organisations ask their suppliers for it too.
Every laptop, phone and cloud service that can reach company data is in scope, including those used by people working from home, and security updates rated high or critical must be applied within 14 days of release.
What is the IASME Governance Standard?
Cyber Essentials checks the technical defences. The IASME Governance Standard looks at how security is run across the whole business. It was developed by the IASME Consortium, through a government-funded project, as an achievable alternative to the international standard ISO 27001, and it covers much of the same ground:
- assessing and managing risk, with the board accountable for it
- security policies that every employee follows, backed by training
- reporting and investigating security incidents
- business continuity and disaster recovery plans that are tested
- protecting personal data in line with the GDPR
Our answers to both assessments were approved at board level and then reviewed by an independent certification body, Capital Network Solutions, accredited by the IASME Consortium. The governance certification is also subject to independent annual review.
Part of our commitment to cyber security
Our consultants work inside our clients’ finance, data and CRM systems, so protecting information is part of the job, not an add-on. These certifications give clients independent assurance that we look after our own systems to a standard the UK government trusts, and we bring the same discipline to the solutions we design and deliver.