About the organisation
The Children and Family Court Advisory and Support Service (Cafcass) advises family courts in England about the welfare of children and what is in their best interests. It works with almost 144,000 children annually whose future is decided by the family courts by providing a service that prioritises their safety, their voices and their needs.
Steps to becoming Cyber Essentials certified
Cafcass took its first steps to becoming Cyber Essentials certified in 2019 when it began looking at best practice guidance around cyber security to tighten existing arrangements. It also wanted to set a good example to its suppliers.
“We wanted to demonstrate our awareness and our security stance so that when we were requiring Cyber Essentials from our suppliers, it wasn’t a one-way street.”
Cafcass found the assessor at their certification body to be extremely helpful throughout the initial certification process, advising them on what changes they needed to make. A mock assessment followed, which identified where aspects of cyber security could be strengthened. Cafcass initially gained Cyber Essentials certification in 2020.
“I think having that close relationship with the assessor is key to being successful. For us [each year] it really helps us to understand what we’re trying to achieve and why we’re trying to do it.”
Obstacles overcome
With staff operating across England and most working remotely, the biggest obstacle to Cafcass initially becoming Cyber Essentials certified was building appreciation of the scheme’s importance for good security hygiene. Another was changing certain habits, such as ensuring that staff always run the necessary updates and system restarts.
Obtaining buy-in from senior management was aided by Cafcass having a dedicated risk and assurance committee. Others bought in once they understood the benefits of the scheme in making the operating environment safer.
Impact
Cyber Essentials propelled cyber security to the forefront of the organisation and Cafcass sees the scheme as playing a key role in protecting not only staff, but the children and families with whom it works in terms of keeping their information safe.
Cafcass believes that Cyber Essentials has made it more aware of cyber security threats facing the organisation. It also believes that the use of multi factor authentication (MFA) has likely led to a reduction in the number of successful cyber attacks. Furthermore, the use of hardware and software tokens has improved security by preventing unauthorised access to the organisation and its supply chain.
“We now apply security patches within 14 days of release. This means we haven’t been exposed to many of the types of risks that could impact others.”
Cyber Essentials has also reduced the organisation’s cyber security burden.
“It frees up time, whereas I may have had to fill in questionnaires taking up to four hours to complete. That time can now be spent on other things, i.e. the real things that are important.”
Final message
Cafcass’ message to other organisations considering becoming Cyber Essentials certified is not to worry about not getting everything right the first time around as it’s a journey of continuous improvement.
Organisations seeking to achieve Cyber Essentials may need support achieving certification. Find free guidance and professional advice on our Help and Resources page.
Apply for Cyber Essentials here.
This case study was generated as part of the DSIT Cyber Essentials impact evaluation. To access the full evaluation, please click here.