Cyber Essentials Certification – a Guide to the 2022 Update
Cyber Essentials and Cyber Essentials Plus changed in 2022. New infrastructure requirements and amendments to technical controls announced by the National Cyber Security Centre (NCSC) came into force on January 24, 2022. If your organisation required Cyber Essentials certification, you needed to know what the 2022 update meant and how it affected certification.
It was essential information for any organisation looking to become certified or work as a supplier to organisations such as the Ministry of Defence (MoD) and the National Health Service (NHS).
What was the Cyber Essentials 2022 Update?
The new Cyber Essentials question set – known as Evendine – launched on January 24, 2022. It was the most significant change to the standard since it was introduced. While new question sets had been released previously, there had been very few changes to the scheme requirements themselves. With the Evendine release, there were significant changes to the scope requirements and the controls that needed to be applied to the devices within that scope.
The changes were designed to modernise the scheme and take into account key technology trends and infrastructure changes that had become commonplace. Trends such as a move to greater home working and Bring Your Own Device (BYOD) were now part of the scheme.
The 2022 update included changes to Cyber Essentials relating to:
The Cyber Essentials standard was constantly evolving, and usually, there were annual updates to the question set. The reason behind these updates was that the threat landscape was continually evolving, too, and attacks that had been successfully thwarted in previous years might well have moved on in sophistication and delivery, ensuring success for criminals.
Cloud service changes
The Evendine update introduced significant changes to what must be included in scope, with the most noticeable being the inclusion of all cloud services. From the introduction of Evendine, all cloud services were required to be within the scope of Cyber Essentials.
- Infrastructure as a Service (IaaS) – was already in scope with Cyber Essentials and covered on-demand IT services such as storage and computing.
- Software as a Service (SaaS) – previously regarded as out of scope, included on-demand software services such as cloud-hosted business applications.
- Platform as a Service (PaaS) – had been a grey area that generally required careful consideration as to whether the service should be in scope or not, and covered development and deployment platforms in the cloud, such as database management.
It was now impossible to certify only the cloud elements of the business or servers. The NCSC and IASME clarified that end-user devices must also be in scope.
The 2022 update meant that:
- It was no longer acceptable to descope all end-user devices.
- It was not possible to descope cloud services used by the organisation.
- All devices, software, and firmware in scope (including BYOD) had to be supported, with all controls applied.
Password requirement changes
There were also changes to passwords and 2-factor authentication (2FA) requirements.
From January 2024, all administrative users of cloud services had to have multi-factor authentication (MFA) applied, and all standard user accounts needed MFA when certifying in 2023.
In the meantime, user accounts needed either:
- 12-character passwords, or
- 8-character passwords when there was a technical control to deny bad passwords.
The NCSC requirements document described the new password controls as:
Workers had to be educated on how to avoid common or discoverable passwords, such as a pet’s name, common keyboard patterns, or passwords they had used elsewhere. This could have included teaching people to use the password generator feature built into some password managers.
Encouraging people to choose longer passwords. This could have been done by promoting the use of multiple words (a minimum of three) to create a password (e.g., ‘Three Random Words’).
Providing usable secure storage for passwords (for example, a password manager or secure locked cabinet) with clear information about how and when it could be used.
Not enforcing regular password expiry and not enforcing password complexity requirements.
There had to be an established process to change passwords promptly if the applicant knew or suspected the password or account had been compromised.
Requirements to declare devices and BYOD
Servers and end-user device quantities had to be declared, and a change was that the make and model of the device, as well as the operating system, had to be declared. A common fault causing assessments to be sent back was that both edition and version numbers were required.
It was recommended to maintain an up-to-date asset register, which had to include BYOD devices, to provide the required information.
As tracking BYOD devices could be complex, it was suggested to have a process for “on-boarding” a BYOD device so that the owner/make/model/OS could be documented whenever a staff member wished to use their own device to connect to company data.
Staff also needed to be prepared for the possibility that, if they chose to use a BYOD device, the device might need to be tested during Cyber Essentials Plus auditing, which should have been covered through employment contracts or internal policy. The recommendation was to cover this off with HR to ensure adequate coverage for BYOD.
All BYOD devices that accessed business data – including emails and cloud services – had to be regarded as being in scope and had to be fully declared. They also needed to have all the controls applied to them in the same way a corporate device would have.
If mobile devices were only being used to access a virtual desktop infrastructure (VDI) solution, this brought the device into scope in the same way as if it could access corporate emails.
If BYOD devices were only used for voice calls, SMS text messages, or as a platform to receive 2-factor authentication codes, then this did not bring them into scope.
It was necessary to assess whether BYOD devices were essential to the business.
Unless BYOD was treated in the same way as corporate mobiles, where all updates had to be applied, a minimum 6-character pin applied (with rate limiting and lockout in place), and the device was not jailbroken or rooted, then it was possible to fail Cyber Essentials and/or Cyber Essentials Plus.
Cyber Essentials 2022 – thin clients
From 2023, all thin clients needed to be in support and receive security updates. The Evendine question set included questions around thin client use.
Clarification around remote (home) workers
There was clarification around organisations that employed home workers. If the home network used an ISP-provided router, this was seen as being out of scope. Should the organisation have provided a router for the home worker, then this was in scope.
Homeworker computers had to have the software firewall active on the device. If this was in place, then home networks were out of scope. In the interests of best practice, it was suggested to set the public firewall profile to deny all incoming traffic.
Routers and firewalls requirements
These had to have a minimum of an 8-character password and either 2FA in place or limit the login to internal addresses or a select few external whitelisted IP addresses.
This was also tested as part of Cyber Essentials Plus.
There were also some significant changes to the Cyber Essentials Plus testing and auditing process.
What did the changes to Cyber Essentials Plus 2022 mean for an assessor?
Cyber Essentials Plus Assessors saw many organisations fail the standard due to insufficient patching of operating systems and applications. Applying security updates within the mandated 14-day period presented a challenge to some organisations, and the changes only resulted in the bar being raised.
The reason behind this was that previously, they were allowed to discount some vulnerabilities that required methods of attack, such as local access to the machine or tricking a user into action. Additionally, the functionality of the attack had to be proven with a reasonable level of certainty.
In the new Cyber Essentials Plus, all critical and high vulnerabilities had to be remediated regardless of the attack vectors. This was a significant change, and many organisations that Assessors had previously been able to pass would now fail under the new assessment.
A new test of all cloud services was introduced with initial checks that all administrator accounts had 2FA enabled. From 2023, all accounts, even standard user accounts, needed to have 2FA present.
There were further tests to ensure that administrators did not work on a day-to-day basis with admin privileges, which was often a contentious requirement for developers.
Even for developers, having admin privileges in the course of everyday work was prohibited.
For macOS/Linux devices specifically, there had to be account separation between the user account (used for day-to-day work such as email/web browsing) and the administrative account of the machine. It was not compliant for a user to be a part of the “sudo” user group – there had to be complete separation.
