Cyber Advisor (Cyber Essentials) Scheme

In the past, organisations seeking help from an NCSC approved cyber security expert tended to be very large and complex or be from the defence, security or banking industries or part of the critical national infrastructure. If your requirements are complex, or you operate in a nationally critical sector, see the NCSC Assured Cyber Security Consultancy scheme pages.

Today, expedited by the pandemic, the widespread adoption of digital technology for products and services has made basic cyber security essential to every business that connects to the internet. Accessibility to this protection contributes to the national security of the UK. Consequently, the NCSC aims to extend its reach to offer a trusted source of cyber security advice to a wider range of organisations.

Despite a growing emphasis on cyber security, many organisations often find it hard to choose the right help to meet current guidance. The Cyber Advisor scheme aims to ensure the understanding and application of trusted cyber security advice.

Cyber Advisors will initially focus on helping organisations to implement the five Cyber Essentials Technical Controls. This service will be known as Cyber Advisor (Cyber Essentials). The name includes Cyber Essentials in order to differentiate them from any future assured Cyber Advisors assisting small organisations in other areas of cyber security.

The Cyber Essentials standard has been adopted because the NCSC recognises this as a good baseline standard that defends against a range of commonly experienced cyber attacks, including ransomware attacks.

Cyber Advisors (Cyber Essentials) can help organisations assess the gap between their current cyber security stance, and that achieved by implementing the Cyber Essentials technical controls. This service is tailored towards small and medium sized organisations and the Advisors have all been assessed not just on their technical knowledge, but also their ability to work specifically with small organisations.

With the specific needs of an individual business in mind, Cyber Advisors can provide hands-on support to help the organisation take recommended actions.

An organisation will be helped to meet the Cyber Essentials technical controls, however, they do not necessarily need to be aiming for Cyber Essentials certification. The advice offered by Cyber Advisors will help prepare an organisation should they wish to certify, in which case, they will need to apply through a Cyber Essentials Certification Body.

Cyber Advisors can help organisations by:

• Conducting Cyber Essentials gap analysis to assess the organisations internet-facing IT, identifying where it fails to meet the Cyber Essentials controls
• Developing reports on the status of the organisation’s Cyber Essentials controls i.e. detailing the requirements that are met and those that are not; describing why controls are not met and the risks the organisation is exposed to; recommended actions to take
• Working with the business to agree remediation activities
• Planning remediation activities that align to the risk and business priorities
• Implementing remediation activities – or guide technical teams to do so – sympathetically to operational activities
• Developing and presenting post-engagement reports summarising the engagement and detailing any remediation work completed, pointing out any residual risk with recommendations for reducing those risks

Any organisation can find a qualified and approved Cyber Advisor working within companies assured by the NCSC. This makes it simple for organisations that are starting out on their cyber security journey to benefit from expert skills and advice offered by qualified individuals.

How to select a Cyber Advisor

When choosing a provider, you may wish to consider whether they have the relevant experience in the sector you operate in, or in the technology that you use.

There is no recommended price for assured Cyber Advisors to charge. Each job will vary dependent upon the size of your organisation and the complexity of your IT.

All Cyber Advisors have passed an independent assessment which measured their:

• knowledge and understanding of the Cyber Essentials’ technical controls
• competence in providing practical, hands-on support
• ability to understand and work with small and medium sized organisations

All Cyber Advisors must work for a company which has met the NCSC’s standards and been accepted as an Assured Service Provider. Customers are assured that the advice they receive can be trusted.