Cyber security isn’t only about preventing an attack. Businesses also need to be able to respond, recover and continue operating when something goes wrong. The focus on cyber resilience is becoming increasingly important, with both the UK Government and the National Cyber Security Centre encouraging organisations to look beyond technical defences and consider how they would manage and recover from a cyber incident.
Cyber resilience is also an important part of IASME Cyber Assurance certification, which looks beyond technical controls at how cyber security is managed across an organisation.
This broader approach to cyber security is something we regularly discuss with our clients, so it’s important that we apply the same principles within our own business. With that in mind, .net Highland Ltd, the company behind Secure360, has achieved IASME Cyber Assurance Level One, building on our existing Cyber Essentials Plus certification.
How is it different from Cyber Essentials Plus?
Cyber Essentials focuses on five technical controls designed to protect organisations against common cyber attacks. With Cyber Essentials Plus, those controls are independently tested.
IASME Cyber Assurance takes a wider view. It looks at how cyber security is managed across the business, including who is responsible for it, how risks are managed and how access to sensitive information is controlled.
It also considers staff training, suppliers, backups, business continuity and incident response.
Level One is a verified self-assessment reviewed by an independent Assessor. It isn’t the same as the audited Level Two certification, but it requires an organisation to examine a broader range of security arrangements than Cyber Essentials alone.
Why did we want the certification?
For us, it was important to check that the standards we discuss with clients are reflected in the way we manage security within the business.
IASME Cyber Assurance Level One gave us a structured way to do that. We reviewed our policies, responsibilities, systems, suppliers and processes against the requirements of the standard.
It also meant checking that what is written down reflects what actually happens in practice. Responsibilities need to be clear, and processes need to work when they are needed.
Could IASME Cyber Assurance be useful for your business?
It’s possible to have good technical security in place and still have gaps in the way security is managed across the wider business.
You might already use multi-factor authentication, keep devices updated, protect endpoints and have Cyber Essentials certification. But what happens if a key supplier suffers a cyber incident? Is there a documented process for removing access when an employee leaves? Does everyone know what to do following a data breach? Could the business continue operating if an important system became unavailable? These are the kinds of questions IASME Cyber Assurance is designed to address.
It can be particularly useful if customers are asking for evidence of your security arrangements, you handle sensitive or personal information, or your business forms part of a larger organisation’s supply chain. It can also give directors and trustees a clearer view of how cyber risk is being managed.
For some businesses, many of the right security measures may already be in place, but the processes around them have developed informally over time. Responsibilities may not be documented, or it may be difficult to demonstrate what happens in practice when a customer or another organisation asks for evidence. IASME Cyber Assurance provides a framework for bringing those arrangements together and identifying where more work may be needed.
Going through the process ourselves has also given us first-hand experience of what it involves. When we talk to clients about their own security requirements, we know the questions they’ll need to answer because we’ve had to answer them ourselves.
Helen Kings, Secure360.io