I’m delighted to start this latest blog with the news that AARC Professional Services (AARCPS) has now achieved Cyber Essentials Plus certification, clearly demonstrating to our clients and the wider rail industry our commitment to providing a high level of compliance with IT data security.
But what is Cyber Essentials/Cyber Essentials Plus certification and why the need for them in the first place?
Cyber Essentials itself is a UK Government-backed annually renewable certification scheme that helps keep organisations and their customers’ data safe from cyber attacks. It is also the Government’s minimum baseline standard for cyber security for organisations of all sizes, is a mandatory requirement for all Government supply chain contracts (and an increasing number of commercial tenders) and is recommended by the National Cyber Security Centre (NCSC) as the minimum standard of cyber security.
It is also aligned to the following five technical controls designed to prevent the most common internet-based cyber security threats:
- Malware protection – The sustained use of appropriate anti-virus software across the organisation
- Patch management – Having the necessary processes in place to enable all company software to be updated in a timely manner
- Access control – Assess user software requirements on a regular basis and put restrictions in place to ensure that system access and authorities are limited to only those that need it
- Secure configuration – Set all systems up securely, ensuring that appropriate passwords are used
- Boundary firewalls – Prevent unauthorised systems access by ensuring appropriate firewall measures are in place
With around 7.7m cyber crimes experienced by businesses last year, Cyber Essentials aims to help every organisation irrespective of size to guard against the most common cyber attacks. If you/your business has digital assets or stores data, implementing Cyber Essentials can help you to keep your information safe. Statistics also show that adoption of Cyber Essentials helps:
- Organisations become more resilient. 92%fewer insurance claims are made by organisations with the Cyber Essentials controls in place
- Build trust. 89%of organisations using Cyber Essentials would recommend certification to other organisations
- Improve competitiveness. 69%of those with Cyber Essentials believe that it has increased their market competitiveness
- Organisations become more informed. 88%believe Cyber Essentials has improved their understanding of cyber security risks
Cyber Essentials certification also helps to demonstrate to clients/prospective clients that cyber security is a priority across your organisation, with certification including cyber liability insurance for any UK organisation that certifies its whole organisation and has less than £20m annual turnover.
Cyber Essentials Plus takes that commitment to the next level via a technical audit of your respective organisation’s IT systems, providing independent verification that the requisite systems/controls are in place, whilst giving greater assurance that your organisation is compliant.
In view of the above and in today’s IT dependent world, for AARCPS, the ability to demonstrate our commitment to the provision of a high-quality service supported by the appropriate level of data protection/security has been absolutely critical to the development of the business, hence us having first started our Cyber Essentials journey in 2020. It has also helped to underpin our professional credentials and is a clear demonstration to our clients and the wider industry that we see cyber security as a necessity, not a ‘nice to have.’ As such, and as part of the move to Cyber Essentials Plus, we have been running on-line interactive awareness training for all of our associates since 2023. This was an initial 12-month programme, with refresher training now in place for new starters and other team members as and when required.
Last but by no means least, I’d like to take this opportunity to personally thank Pete Rucinski and Aidan Sankey of Assure Technical, whose support has been instrumental in helping AARCPS to achieve both Cyber Essentials and Cyber Essentials Plus and who helped to co-ordinate the aforementioned awareness training. You can find out more about Cyber Essentials/Cyber Essentials Plus at https://www.ncsc.gov.uk/cyberessentials/overview and Assure Technical at https://assuretechnical.com/cyber-security-certifications/cyber-essentials/.
