Certification can apply to organisation’s full enterprise IT or just a subset. Either way, the scope of the network needs to be clearly defined before the certification process can get underway.

Please refer to the “certification process stages” section of the Cyber Essentials Guide.

As part of the certification process and scope, CCN will carry out a pre-assessment security audit on your network which will include a review of your staff awareness methodology and internal security processes. On completion, you will be advised as to any changes that may be required.

Once the organisation has determined its scope and the Audit is complete the next step to certification is to complete a self-assessment questionnaire (SAQ). This comprises 70 questions across 8 sections (including the 5 control areas); all sections must be passed for certification to be awarded.

Additional assessment such as internal and external vulnerability scans against the public – facing infrastructure patch levels and system configuration will be carried out along with a security and anti-malware test to ensure the systems are resistant to malicious email attachments and web binaries.