Cyber Essentials is the UK Government-backed scheme that aims to help organisations protect themselves against common cyber threats. Organisations who achieve Cyber Essentials demonstrate they have considered and committed to bolstering their defences against common threats of cybercrime and reduce vulnerabilities of businesses to an accredited government standard. Backed by the UK Government, the Cyber Essentials scheme is not mandatory for everyone.

The European Union’s GDPR has been enacted into UK law and its regulations and requirements are mandatory on all businesses regardless of size.

Cyber Essentials scheme is not covered by binding regulation, instead, it offers organisations and businesses a means to demonstrate their commitment towards addressing cybersecurity by achieving an accredited and registered certification standard.

However, for certain businesses Cyber Essentials is a mandatory requirement in order to secure contracts and in this blog post we describe the conditions under which certification can be necessary.

Government Contracts

Cyber Essentials is mandatory for businesses looking for specific government contracts.

Unless your business achieves Cyber Essentials, you will not be able to bid for such contracts at all. In general, these contracts will involve the handling of personal information or delivering certain IT products and services.

Essentially all government contracts where your business will be required to:

• Handle the personal information of any UK citizens; i.e. bank details or home addresses.
• Handle the personal information of any government employees, ministers, or advisors; i.e. payroll or expenses information.
• Deliver IT products or services designed to store, process, or transfer data at an official level.

Cyber Essentials certification is mandated for businesses entering into these contracts and demonstrates that they have achieved the standards and meet the technical requirements defined in by the scheme.

For all businesses looking to bid for government contracts that involve one of the above characteristics, it makes business sense to consider achieving Cyber Essential certification first and not waiting to the last minute.

Ministry of Defence Contracts

The UK Ministry of Defence (MOD) places further emphasis on businesses being Cyber Essentials certified and requires all its suppliers to comply with the Cyber Essentials scheme.

The MOD stated in its announcement that this requirement must flow down to the supply chain, effectively mandating that both organisations directly conducting business with the MOD, as well as organisations delivering to the MOD supply chain must be Cyber Essentials certified to carry on doing their business or to win contracts for businesses going forward.

Importance of Cyber Essentials

Should your business get a Cyber Essentials certification even if it is not mandatory for your business?

Yes.

Cyber Essentials is an increasingly important certification to achieve for all businesses of all sizes in the UK. Even where not mandatory, the rise of consumer and client awareness of the impacts of cyber attacks or the consequences of personal data breaches, have rightly seen an increased demand for evidence that your business takes its responsibilities seriously and invests in cyber protection.

Be prepared to be asked by your clients to prove that you are committed to maintaining cybersecurity and with Cyber Essentials certification being able to quickly respond to prove it.

There are additional benefits to achieving Cyber Essentials, other than bidding for a government or MOD contracts. For SMEs with little or no IT support or expertise, it provides a basic first step towards cybersecurity. Most SMEs lack adequate cybersecurity measures because they mistakenly feel that they will not be targeted. This is a misconception:

• More than 60% of SMEs suffered a breach in 2016.
• The average cost of a breach to these UK-based SMEs was £16,264.

It makes good business sense to invest the minor cost of certification to reduce this risk and mitigate any losses by achieving Cyber Essentials certification.

Conclusion

The Cyber Essentials scheme is mandatory for businesses and suppliers looking to bid for certain government contracts and all Ministry of Defence contracts. If you are a business that deals with the government or major industries in the UK, then it is essential you consider getting certified and maintaining your annual re-certification to keep the business contract.

For all other businesses, demonstrating to clients and customers that you have taken the essential steps to achieve basic cybersecurity, by being Cyber Essentials Certified, makes sound business sense.

CyberSmart is a cybersecurity service provider that helps organisations secure their systems and become Cyber Essentials certified. If you would like to discuss further on whether Cyber Essentials is mandatory for your business, contact us right away.

Over the last few years, cyber attacks have become an imminent danger for businesses. With this growing threat, cybersecurity is now a responsibility rather than a luxury.

Despite this, most SMEs are at risk of being breached either through a lack of awareness or the lack of action. This is a concern for SMEs since the fines and costs associated with cyber attacks can put them out of business.

A KPMG survey suggests that only 23% of small businesses prioritise cybersecurity as a top concern. This is being said even though 60% of small businesses have experienced a cyber breach that led to brand damage and loss of clients.

As an SME, this is the right time to act and move forward with the cybersecurity agenda. The UK Government is helping these businesses by providing a range of standards and guidelines. The most useful of these perhaps is Cyber Essentials, particularly for small businesses.

In this blog post, we highlight benefits of Cyber Essentials for SMEs.

What is Cyber Essentials?

Cyber Essentials is a scheme backed by the UK government that was launched in 2014. The standard provides simple but effective guidelines that protect organisations against cyber attacks.

The primary aim of this scheme is to encourage and guide organisations to adopt the best practices in their information security strategy. Once fully implemented, Cyber Essentials will provide organisations with basic protection against the most prevalent cyber threats.

Even though it is not the silver bullet to cybersecurity, it is the first step in the right direction for SMEs to protect themselves in this age of cyber warfare.

Benefits of Cyber Essentials for SMEs

There are a number of benefits that SMEs can look forward to when getting certified for Cyber Essentials. Here are four reasons why Cyber Essentials is important for SMEs.

1.      It helps protect against common cyber attacks

A majority of cyber attacks exploit basic weaknesses in organisations such as the lack of updated software or well-configured firewalls. Often, these types of attacks are simple to defend against with straightforward strategies and Cyber Essentials provides those.

While there is no security strategy that will stop a hundred per cent of the attacks, Cyber Essentials helps organisations mitigate the risks of the most likely ones by providing a strong base for SMEs to work with.

2.      It prepares you for being GDPR compliant

The General Data Protection Regulation (GDPR) came into force earlier this year across the EU. As part of this regulation, organisations that are processing personal information of EU citizens need to protect this data against data theft and unauthorised access. If an organisation is found to be negligent to the GDPR in the event of a breach, the business could face fines of up to 4% of their global turnover.

Following the Cyber Essentials scheme can assist businesses in preventing these heavy fines and prepare them for compliance with GDPR. Even though the GDPR requires a lot more than the five controls in the Cyber Essentials scheme, the latter allow you to audit your internal security and fend off the basic security threats. It is the first step towards preparation of GDPR compliance for SMEs.

3.      It enables you to bid for government contracts

The UK Government has made it mandatory for suppliers to be compliant with the Cyber Essentials scheme to be eligible to bid for government contracts.

If a contract involves certain technical services or handling of sensitive information, then you need to be Cyber Essentials compliant. Therefore, for SMEs that are looking for a government contract, Cyber Essentials is the only way forward.

4.      It shows customers and vendors that you take cybersecurity seriously

Customers and even vendors can often be sceptical in dealing with you if you display little or no concern for cybersecurity. Becoming Cyber Essentials certified can help you establish the trust of clients and partners.

Once you are certified, you will be able to display a Cyber Essentials badge on your business website. This badge proves to customers, vendors, and investors that you take the security of systems and integrity of data seriously. This is particularly important if you are storing, processing, or transferring personal information or hosting sensitive data.

Conclusion

SMEs are as likely, if not more, as large organisations to be at risk of a cyber attack. An important step that SMEs can take to improve their cybersecurity is to get Cyber Essentials certified. This has a number of benefits including protection against prevalent cyberattacks and a competitive advantage for bidding on government contracts.

CyberSmart partners with SMEs to advise them on how to become compliant with leading schemes and standards such as Cyber Essentials. If you would like to learn we can help you become Cyber Essentials certified or Cyber Essentials in general, get in touch.

Following on from our last blog post, “Steps to prepare and pass Cyber Essentials” this post builds on that advice and discuses the time it takes to achieve certification.

Cyber Essentials scheme encourages businesses to adopt best practices to protect themselves against common security threats. With time, the variety and complexity of these cyber threats are increasing, consequently, cybersecurity standards such as such as Cyber Essentials are constantly evolving their requirements.

This is the reason most standards and schemes have a validity period for their certification. Cyber Essentials is reviewed annually and the UK Government recommends that all certificate holders must review their certification annually to remain on the official register of certified businesses.

In this blog post, we discuss the validity period for Cyber Essentials and how the recertification process works.

How much time does it take to get your business certified?

When you apply for Cyber Essentials, and following payment of £300 plus VAT (at the time of publication), you will receive a self-assessment questionnaire. You have up to 6 months to submit the questionnaire to the certifying body for review and a decision on your certification. If you fail to submit your self-assessment questionnaire within this period, your application will be cancelled, and you will have to make the payment again.

On average, we have found that it takes small businesses around 2 weeks to complete their assessment.

Following submission, it usually takes on average 3 days for the certification body to give you a response. If everything is in order, they will award you your Cyber Essentials certification.

In the case of Cyber Essentials Plus, the process takes a little longer and will typically involve an additional on-site audit and a system vulnerability scan from a registered competent contractor.

Depending on the time and size of your business, it can take up to 6 months to receive a Cyber Essentials Plus certification.

How long is your certification valid for?

There is no definitive period of validity for a Cyber Essentials certification. But, the UK government recommends that businesses renew their certification annually. If you fail to renew your certification within a year, you will be removed from the list of certified organisations.

Cybersecurity is continuously evolving with new requirements and best practices being established every day. To keep your business protected, it is important you stay updated with these new developments. Re-certifying helps demonstrate to your clients that you are improving your security to counter newer threats.

Your accreditation body should inform you by email around a month before you are expected to re-certify. When you receive this email, it is a good time to start preparing for the re-certification process.

How long does will it take to re-certify?

The recertification process is almost the same as the certification process.

Therefore, time durations are similar and you should receive your updated certification within 3 days of you submitting your assessment.

You should factor in the personal time and investment to re-enter all the original information from your previous applications to the recertification questionnaire as the sequence and content do change annually to reflect the changing security environment and requirements for cybersecurity.

In case of changes to the security infrastructure of your organisation, your answers should reflect the changes. If there are no changes, then you can copy and paste the answers from the questionnaire that you filled the previous year.

Conclusion

The bottom line is that you and your business need to re-certify annually to retain your accredited Cyber Essentials registration. The scheme’s current certified businesses are registered on a publicly accessible register, so there is no hiding if you have not completed your annual recertification.

The benefits of getting re-certified include improved protection against emerging cyber threats and reduced risk to your business through an annual review of your adherence to compliance standards.

CyberSmart is an automated compliance service that helps businesses seamlessly track and renew their Cyber Essentials certification. In our next post, we will look at how CyberSmart has been proven to speed up the process for you and your business, saving valuable time, effort and potentially cost. If you would like to learn more about how we can help you remain protected and compliant, get in touch with us right away.

The Cyber Essentials scheme provides a basic yet effective framework for businesses to protect themselves against cyber attacks. Getting Cyber Essentials certified is one of the first steps that any organisations can take to protect their digital assets and their personal data, and for those seeking to engage in the UK Government supply chain contracts, it provides the mandatory certification required to bid.

Like all official certifications, achieving Cyber Essentials requires preparation and business investment in time, cost and some technical awareness.

In this blog post, we present a guide on how to prepare and pass Cyber Essentials.

1.     Create an Information Security policy

The first step is to develop a well-planned information security policy for your organisation. Your policy should establish the requirements and rules for cybersecurity at your company and to achieve Cyber Essentials, your policy should include:

• The requirements for handling and processing personal data of customers, employees, and third-parties.
• A password policy that describes the minimum requirements for passwords (such as length and complexity).
• A set of guidelines that define what users can and cannot do, including access controls and internet usage.

Your security policy does not have to be long and complex document filled with technical details. Instead, it should document rules for cybersecurity in a simple, clear manner that all your employees and other third-parties with access to your systems or data can understand and readily comply with.

2.     Assign a Data Protection Officer

Although not mandatory for all organisations, appointing a single senior employee as a Data Protection Officer (DPO) can help you enforce the information security policy within your organisation.

For SMEs, assigning a DPO can be an important step as they can coordinate all the business security initiatives, and for external parties and IT users, they are the business’ single point of contact for queries and concerns related to security.

Cyber Essentials requires businesses to complete and submit a self-assessment questionnaire, and provide relevant evidence to support answers, in order to achieve certification.

Having a single point of focus in a DPO ensures that everybody understands who is responsible for completing the questionnaire and who to go to for best practise advice and guidance.

3.     Keep track of your digital assets

To make sure that all software and devices are protected, you should keep an inventory of digital assets. Ensure that you include the details of software versions and updates for both software and devices.

Knowing what and where your assets are is good practice and especially so with information security assets. It helps you keep software updated, which can often be essential, and the best first step to protect your systems and data.

Knowing what devices are present on, or can connect to your network, is the best way to identify unauthorised devices and to take action to remove or isolate them. Tracking your digital assets enables you to identify vulnerabilities and to keep a close watch on devices within your network.

4.     Enforce access control

Access control ensures that only authorised personnel have access to sensitive information and enforcing strong access control is an essential step for achieving Cyber Essentials certification.

Make use of a Role-Based Access Control (RBAC) system ensure IT users have only have the privileges that they need for their job role and access to only those systems they need to be effective and operate safely.

5.     Make use of the right tools and configurations

A firewall and antivirus are essential security tools required for Cyber Essentials.

Your firewall helps protect devices on a network from external threats such as those from the internet.

Your antivirus software protects your systems from viruses and other malware that can harm them, or corrupt or steal sensitive, personal or proprietary data.

You should ensure your firewalls are properly configured to disallow access to malicious content. Making use of a firewall and antivirus will help your business prevent the most common types of cyber attacks.

6.     Conduct regular security reviews

To ensure that your digital assets remain safe and protected, it is important to document, track, and review the effectiveness of the cybersecurity measures you have taken.

Knowing the strengths and weaknesses of your organisation’s network can help you fine-tune cybersecurity for better protection, especially as you grow. You should conduct regular security reviews to:

• Track all devices and software, including when they were last updated.
• Understand the types of devices being used throughout your organisation (e.g. laptops, desktops, servers etc).
• Determine the effectiveness of your information security policy.
• Ensure that all software and devices are properly configured for secure operations.

Conclusion

If you are a small to medium scale business getting started with cybersecurity can seem daunting, especially if you have no technical IT skills. However, achieving a Cyber Essentials certification is a great way to begin, and for a small investment of time and effort, it can significantly reduce your risk exposure. Take the steps outlined above and you will be well-prepared to pass Cyber Essentials.

CyberSmart is the automated platform to help businesses get and stay secure with recognised certification standards including Cyber Essentials. Businesses can gain certification as individual companies or can join the many organisations that have achieved Cyber Essentials by partnering with us today.

If you have any questions, whether it is preparing for Cyber Essentials, or how to protect your company systems and data, please reach out. We love to talk about Cyber Essentials and help companies with their data protection needs and smart certification

Whether it be personal or operational, stolen data often results in disaster for small businesses. It can result in loss of revenue, customer trust, and reputation for the business. Data breaches are a growing concern for UK businesses, particularly the ones that are scaling to expand their operations.

Implementing security measures at a small-scale is easy, but as your business grows, it becomes more difficult and complex implement efficiently. In this blog post, we provide some effective tips on how businesses can secure their customer data as they scale.

Encrypt your data

One way to increase the security of your confidential data is to store and transmit it in an encrypted format. This keeps your data secure even if hackers get access to it. The encryption renders the information unreadable and hence unusable by the hackers.

Encryption is a great prevention technique that solidifies your organisation’s defences against hackers. There are numerous encryption techniques and standards that can be used to protect your data. Consult with your service provider or security expert on which one you can use to ensure data confidentiality.  

Disable remote access

Most data breaches can be attributed to hackers gaining remote access to the network. To protect your business against this, it is recommended that you limit remote access to your network.

This can be achieved by disabling remote access from all external networks. Or, a possible way of limiting remote access is to whitelist devices that can remotely access your network. The remote access should be disabled for all other devices other than these.

Limit data accessibility

Access control or limiting data accessibility is an effective way to secure control data. It limits users within your network to access only the data that they need for their job.

Regardless of how well-known or trusted an individual is, their access to information should be restricted. For third-parties such as clients, you should create guest users that can only access the information that you wish to share with them.

There are several benefits of using access control. Firstly, it helps you to hold users accountable in the case data is illegally manipulated. Secondly, it allows for damage control in the case hackers breach your network and gain access to a user account. The hackers will only be able to access the information which the breached account can.

Educate your employees

Employees are integral to an organisation’s information security plan. Hackers can breach even the most advanced cybersecurity defences because of a simple mistake by an employee. For instance, you might have a strong password policy but if hackers can still manipulate employees to give away their passwords.

To prevent this, it is important to educate your employees. This can be done by implementing an information security policy and conducting training sessions. The information security policy should provide best practises and guidelines for employees. For instance, it should require employees to not share their personal information with anyone.

In the case of a breach, your information security policy should provide guidelines on what employees should do. New employees should be made aware of the information security policy and how to comply with it through training sessions.

Conclusion

It is essential for businesses, particularly SMEs that are growing, to secure their customer data. A breach can result in severe financial loss and irreparable reputation damage. Fortunately, you can take some measures to protect your information as your business expands. You can encrypt your data, limit remote access and data access, educate your employees, and monitor data for insider attacks.

CyberSmart partners with businesses to help them protect themselves from 80% of attacks. We provide automated compliance services that ensure businesses follow best practises for security. Feel free to reach out to us if you would like to learn more about how to secure your customer data.

Cyber attacks have grown significantly in number over the years. Among these attacks, small businesses and startups are the most common targets. Factors such as the lack of access control or absence of an information security policy make businesses vulnerable to breaches.

It has become essential for SMEs to remain vigilant. As a business owner, you need precautionary steps to protect yourself against cyber attacks.

In this article, we guide you on how you can protect your business from cyber attacks, free of cost.

Develop a strong information security policy

The first step towards protecting your company from cyber attacks is to develop a strong security policy. Such a policy should consist of rules and guidelines that cover all aspects of the company’s cybersecurity. It is not important to just create an information security policy, but to enforce it as well.

In the 2016 cyber security intelligence index, IBM found that 60% of their cyber breaches involved employees. Even though most of these had wrong intentions, more than one-fourth of these incidents happened mistakenly, when the employees opened spam pop-ups, emails, or links.

This is the reason it is important to make sure that employees are aware of the information security policy. Documenting a formal security policy with detailed guidelines is the best way to keep your employees aware.

For instance, a clause found in most security policies is to make sure that strong passwords are used. For making the employees aware, you can document and pass out requirements such as passwords should be a minimum of 8 characters in length with special characters.

Similarly, a strong information security policy should have rules to minimise risk from the use of personal email, public Wi-Fi, third-party software, and external URLs and links.

Make use of encryption

All data that is saved on a company’s server or the cloud should be encrypted. The encryption of data ensures that even if data is breached, it cannot be used for malicious purposes.

Basically, encryption converts the data into an unreadable format until a specific key is provided to access the data. You can use a software or hire a third-party vendor for this purpose.

Businesses store confidential information about employees and customers such as their credit card information and national insurance number.

It is essential that you protect this information from getting breached in the first place. However, as a fail-safe, encryption should be used to prevent hackers from accessing the information.

Control access to restricted information

A simple rule of thumb for businesses should be: all information should not be available to everyone. This is because it makes your business more vulnerable. The more accessible your information, the higher the number of possible entry points for the hackers.

Sensitive data such as employee or customer information should be accessible by certain people only. This is known as access control. With access control, there are fewer chances of access by an unauthorised person.

This is an important step for securing your company from cyber attacks. You can implement access control by simply defining user roles and establishing user types within the system.

Once access control has been implemented, you should conduct a session to inform employees about compliance with the rules. For instance, you should tell them what kind of access is unauthorised, and who is allowed access to what data.

Update software and operating systems

A common entry point for hackers is by making use of known exploits in software and operating systems. Therefore, the developers of such software provide regular updates and patches to fix known exploits.

Cybersecurity is not concerned with the use of high-end premium software, but rather how updated your software is. It is best practice to always keep your software and operating systems updated. Schedule your systems to auto-update whenever a security patch or update comes out to minimise vulnerabilities.

Conclusion

With cybercrimes on the rise, businesses are now in an urgency to protect themselves. You can improve your business’ cybersecurity by following the strategies that we have outlined above.

Even if you cannot spend considerably on cybersecurity, these free ways will help you protect your business from cyber attacks.

CyberSmart knows the importance of protecting yourself against breaches. If you are looking for more information on the strategies above, or would like to learn about how to protect, contact us to get in touch with a professional from our team. We will help you strengthen your defenses without having to empty your wallet.

Small and medium sized companies are putting a third (32%) of their revenue at risk because they are falling for some of the common misconceptions around cyber security, leaving them vulnerable to losing valuable data and suffering both financial and reputational damage.

Organisations in any industry face this risk. Due to the capability and sophistication of attackers securing personal data will always be in development. There is still reasons to make it as hard as possible and not be victim to the most basic attacks.

We’ve written a list of the most common reasons organisations get hacked and how you can avoid them.

Difficult to visualise the impact of risk mitigation

Businesses are always looking to increase their growth rate. At early stages, startups tend to spend a high percentage of their time in building innovative features & investing in user acquisition. This usually leaves behind little to no budget for investing on other things such as cybersecurity. Similarly, enterprises need to meet revenue goals for each quarter to maintain their stock prices.

It is often difficult to convince such startups and revenue-driven companies to invest their money in projects that do not directly contribute to an increase in revenue. Planning ahead will save you money in the long term, and cybersecurity is something you should insure your organisation with sooner, rather than later. Pro-active defense rather than reacting to a breach.

It is difficult to quantify how much damage such a breach can cause. In some cases, it can be something trivial that doesn’t require public disclosure (still reported to the ICO). Whereas in other cases, it could permanently damage an organisation’s reputation.

Lack of incentives

Attempting to hack systems is inexpensive. Yet, a successful hack can lead to huge profits for hackers through extortion and theft. The payoff of a successful hack against the relatively little investment is an incentive for hackers.

On the other hand, when businesses take measures towards cybersecurity, there is little incentive to look forward to. From a day-to-day’, high street business perspective, it is not perceived a valuable incentive. Even though the benefits of implementing cybersecurity measures far outweigh the losses.

When your organisation takes out an insurance, you pay your premiums upfront before benefiting from the protected losses in an unplanned event such as a fire or break-in. The same attitude should be considered when protecting your business with cybersecurity, you will be grateful for having put in protections earlier rather than once you’ve been hacked.

Indeed, the motivation for hackers is far greater than the motivation of businesses to protect against them. Think long term, and think about the headache you will prevent from having to deal with a critical situation.

Inadequate training of employees

For the most part, technology can keep its own attackers out. However, it is often the technology users that unknowingly allow hackers and malicious software in.  We have seen that on most occasions, computers are not the points of failure, but instead it is the people who are targeted in social engineering attacks. These attacks are used in a variety of ways to trick employees into providing their sensitive information. For instance, hackers might impersonate officials or large companies/orgs via email, SMS or phone calls. Commonly known as phishing, SmSishing & vishing.

Even if a business has covered cybersecurity from a technological perspective, there is more to be done. Social engineering attacks, can be easily prevented by holding regular training sessions for employees on information security. Emphasising a culture which provides an adequate reporting process without inducing fear on staff job security. Educating employees is one of the best tools to protect your business’ cybersecurity.

Absence of an information security policy

Cybersecurity is not just about intrusion detection and prevention. A key part of it is about ensuring that preventive measures are in place to reduce the risks of intrusion in the first place. This human element is one part of cybersecurity that most often gets ignored.

Any organisation that wants to strengthen its cybersecurity needs a detailed set of guidelines that address these ‘humanistic’ issues. This is where it is important to have an information security policy in place. A well-written information security policy addresses subjects such as password protection, software updates, and access to web content.

It is important to mention that an information security should be documented in a manner that is easy to understand for employees. It is one thing to create a security policy, but the key is to actually implement it within an organisation.

Conclusion

Most businesses feel that cybersecurity is an overhead cost to their operations. It is not until these organisations suffer significant losses to breaches that they realise how important cybersecurity is. With the rise in cyberattacks over the last few years, it is now time for businesses to all sizes to start taking cybersecurity seriously.

CyberSmart provides cost-effective cybersecurity compliance that help businesses protect themselves. If you would like to discuss further on the importance of cybersecurity for your business, feel free to reach out to us.

Keeping computer systems protected against viruses and other forms of malware is one of the first steps towards cybersecurity for an organisation. This is one of the five key requirements of the Cyber Essentials scheme that organisations need to fulfil. The most effective strategy for meeting this requirement is to make use of an antivirus product that can keep unwanted malicious content and programs away.

However, with a wide variety of antivirus products available out there, it can be difficult to choose the best one for your organisation. When choosing an antivirus solution, organisations need to keep a number of factors in mind including the pricing, features, and platforms it supports.

To assist you in making the right decision, we have listed the top 10 antivirus products that you can use when preparing for a Cyber Essentials certification.

1.      Trend Micro Worry Free Advanced

Trend Micro provides comprehensive protection against malware and viruses in the form of its Worry-Free Business Security Advanced antivirus solution. It covers all the basics antivirus features such as real-time scans and scheduled scans and comes with advanced features such as anti-spam, web content filtering, ransomware shield mobile device management, and email security. Additionally, the antivirus software can detect malicious activity through USB ports and external devices to provide security against physical breaches as well.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

2.      Panda Endpoint Protection Plus

The Panda Endpoint Protection Plus is highly rated as one of the best enterprise antivirus products because of its advanced features and budget-friendly price. The antivirus suite comes with a well-designed management console that enables you to monitor systems in real-time. It can protect your systems against basic as well as advanced threats such as malware, spam, malicious web content, and viruses. Even though this antivirus product can sometimes slow down your computer systems, it is a choice worth considering, particularly for small businesses.

Platforms it is available on: Android, Microsoft Windows, macOS, Linux.

3.      Norton Small Business

Norton Small Business provides tailored features to small enterprises, although the protection remains the same as the ones used by large organisations. Other than providing all the basic features for protection, Norton’s Small Business antivirus product provides protection across different devices with a single license. You need a single program to protect both remote and in-office systems and manage them over the cloud. Overall, it is a good value option with a simple installation and configuration process.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

4.      Kaspersky Small Office Security 5.0

An effective and user-friendly antivirus software that you can use to keep your systems protected is Kaspersky Small Office Security 5.0. According to independent testers, it blocks more than 99% of malware and associated hacking attacks. The features include real-time protection, anti-spam, content filtering, and firewall. The firewall is a welcome feature that can prevent unauthorised access to your data, along with strict control of your browsers that disallow access to malicious web content.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

5.      Bitdefender GravityZone Business Security

Bitdefender’s GravityZone Business Security is a good option to consider if you want a high level of protection against malware threats across devices. Even though the installation and setup process of this product is quite lengthy, the antivirus software is quite simple to use once you pass those stages. The features include real-time protection, URL filtering, firewall, anti-malware, and web advisor among others. However, unlike most other antivirus products on this list, Bitdefender does not provide device location services for finding lost devices with this solution.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

6.      Sophos Endpoint Protection

The Sophos Endpoint Protection antivirus is suitable if you are looking for basic protection at a low-cost. Even though it is not as good as the other antivirus products in this list in terms of usability, it does a fair job in keeping away malware and viruses. The plus point is that it is much cheaper than other solutions so it can be a suitable choice for SMEs. The Sophos Endpoint Protection Advanced provides advanced protection feature such as blocking suspicious URLs and monitoring user behaviour to detect threats.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

7.      ESET Endpoint Security

ESET Endpoint Security is a great all-in-one antivirus solution that provides you with protection against all kinds of malware including trojans, viruses, and ransomware. Like Bitdefender, the ESET can be difficult to install and configure but once everything has been set up it works perfectly in protecting the devices within your organisation. Other than its good overall performance, its adjustable pricing policy makes it an option worth considering for SMEs.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS, Linux.

8.      McAfee Endpoint Security

McAfee Endpoint Security is a cloud-based antivirus product that helps you secure and protects all internet-enabled devices within your organisation. It provides a variety of features that help in preventing, detecting, and eliminating malware from computer systems. The excellent customer support provided via multiple channels (email, live chat, and phone) make this a good choice for an antivirus solution.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

9.      Symantec Endpoint Protection

Symantec is a renowned company in the cybersecurity industry, particularly because of its feature-rich product. The Symantec Endpoint Protection Business is widely appreciated because of its high-performance and functionality. It provides a range of advanced protection features including intrusion prevention, firewall, behaviour monitoring, multi-level security policies, remote data management, and device location.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS, Linux.

10. Avast Business Antivirus Pro

Avast Business Antivirus Pro is a reliable antivirus product that comes with a range of malware protection features. The antivirus software provides advanced protection features including browser protection, firewall, anti-spam, remote control options, email protection, and basic antivirus. It provides protection against third-party software installation by providing sandboxing that enables you to run applications in a ‘secured’ environment.

Platforms it is available on: Android, iOS, Microsoft Windows, macOS.

Conclusion

Regardless of how small or large an organisation is, one of the key steps that it can take to protect itself against cyberattacks is to use an effective antivirus solution. This is a major requirement that organisations must meet in order to be compliant with Cyber Essentials.

CyberSmart is an automated compliance service that helps organisations simplify the process of getting certified with leading standards such as Cyber Essentials. If you have any questions about which antivirus product you should choose for your business, get in touch with our experts right away.

A Subject Access Request (SAR) is the Right of Access allowing an individual to obtain records to their personal information, held by an organisation. GDPR, which became applicable in May 2018, provides individuals with the right of access to information.

It is essential that your organisation is aware of the basics of SARs and can handle them effectively to avoid large fines. In this blog post, we provide a six-step practical guide on how you can deal with subject access requests under the GDPR in 2023.

1. Recognise the request

The first step to responding to a SAR is to identify it. The GDPR does not specify how an individual can make a valid request for information. A subject access request can be written or verbal, and it can be made to any part of your organisation including social media.

Therefore, it is best to assume that if an individual asks you for their personal data, regardless of the channel or mode of communication, it constitutes a valid subject access request under the GDPR. It is advised that basic training on the GDPR should be provided to all staff members and managers within an organisation.

Your employees should be able to recognise a SAR and pass it on to the relevant focal person who can handle the request.

2. Understand the time limitations

The GDPR requires you to respond to a SAR within one month i.e. 30 days of its receipt. You must get back to the individual with the requested information without undue delay.

However, you can extend this time period to up to three months if the request is complex, or if the same individual has made a high number of requests. In this case, you must inform the individual that you need more time within one month of the request to avoid any legal issues.

3. Dealing with fees and excessive requests

You cannot charge a fee for providing information to individuals in response to a subject access request. However, there is one exception to this rule. If you receive a SAR that is ‘manifestly unfounded or excessive’, you can charge a reasonable fee to deal with the request or refuse to provide information at all.

There is still some speculation over what requests can be considered manifestly unfounded or excessive and therefore, it is advised that you take caution when refusing a SAR. Similarly, there is no certain threshold for the reasonable fee that you can charge. The ICO guidance suggests that it must be charged on the basis of the administrative costs associated with the retrieval of the requested information.

To be on a safer side, it is best not to charge a fee or refuse a SAR at all. But, if you choose to refuse to deal with a repetitive SAR then you should inform the individual within one month of the receipt of the request with the reasons for refusal.

4. Identify, search, and gather the requested data

The most time-consuming and labour-intensive part of responding to a subject access request is gathering the requested data. If an individual makes a broad request for access to all their personal data, then it can take weeks to identify and search for the information.

Personal data is defined as any information relating to an identifiable natural person under the GDPR. This broad definition makes it difficult to identify the information that you need to provide.

The ICO states that if an organisation processes a large amount of personal information, then it should ask individuals to clarify their request for information. Therefore, a good approach is to ask for additional parameters or specific pieces of information that individuals need from the SAR. However, it is important to understand that you will need to comply with the SAR even if the individual refuses to provide additional parameters.

It is advised that organisations should allocate someone to be in charge of coordinating the process of gathering requested personal data. Document management providers can help you carry out effective searches for data using the right date range and keywords. Even though these services can increase costs, it ensures that your organisation can comply with the information needs of a SAR in time and correctly.

5. Learn about what information to withhold

A challenging aspect of responding to a SAR is to decide what information to withhold from the requester. After you have gathered all the requested information, the next step is to filter out the information that you can legally hold back.

One particular concern is to ensure that when responding to a SAR, you should not disclose the personal data of other individuals. The Data Protection Act (DPA) 2018 states that you should not comply with a SAR if it would require you to disclose information about another identifiable individual.

The exceptions are when the other individual has given their consent to the disclosure, or the organisation finds it reasonable to comply with the request without the consent of the individual. When deciding whether you disclose the information about the third party, you should balance the GDPR’s right of access against the third party’s rights.

Other than this, Section 45(4) of the DPA 2018 specifies special cases when you can withhold personal data of an individual. These include cases when non-disclosure leads to obstruction in an official or legal enquiry, or protection of public or national security.

Therefore, you should be careful about the information that you provide when complying with a subject access request. It is important to understand what information you can withhold to prevent a breach of other’s privacy or to support the public or national interest.

6. Developing and sending a response

Once you have all everything you need for the subject access request, the last step is to develop and send a response to the individual. Organisations need to provide the following information to the requester:

• Legal basis for and purpose of processing the personal data of the individual.
• Third-parties to whom the personal data has been disclosed.
• Existence of the requester’s rights to the information including the erasure of the personal data and restriction of the processing of the personal data.
• Expected period for which the personal data will be stored.
• Categories of personal data.
• Information about the origin of the personal data.

Most organisations will have provided much of the information above in their privacy policy already and so can reuse it from there.

For sending out the response in 2023, the GDPR requires that you provide the information in a concise, intelligible, transparent, and easily accessible form that is understandable by the individual. Secure online portals or encrypted email are recommended ways to deliver the response securely and efficiently.

Conclusion

Understanding how to deal with a subject access request is an important part of complying with the GDPR in 2023. We have outlined a step-by-step process that you can use to comply with a GDPR subject access request from individuals.

Data protection obligations got you in a muddle? Get on top of them quickly and easily with the CyberSmart Privacy Toolbox.