Pioneering Cybersecurity for Complex Organisations: The Cyber Essentials 'Pathways' Initiative

Large organisations with complex infrastructures often struggle to meet traditional Cyber Essentials certification requirements. The Cyber Essentials 'Pathways' initiative offers a flexible, tailored approach, designed to help these organisations achieve robust cybersecurity. ProCheckUp, a leader in offensive cybersecurity services, is uniquely equipped to guide you through this innovative pathway, ensuring your systems are secure and compliant.

What is the Cyber Essentials ‘Pathways’ Approach?

Cyber Essentials is a well-established framework that defines technical controls to protect against common cyber threats. However, there are instances where organisations may face challenges in implementing specific controls due to legitimate reasons. The 'Pathways' approach addresses this by allowing organisations to demonstrate alternative technical controls that achieve the same level of resilience against commodity attacks.

To gain Cyber Essentials certification through the 'Pathways' route, organisations must showcase that their alternative controls are both technical and testable. For example, while user training alone would not suffice, a robust technical solution like advanced threat detection systems could be considered. This outcomes-based approach was validated through initial experiments, proving that it is feasible to achieve equivalent cybersecurity outcomes using alternative measures.

Moving from Experiment to Proof of Concept

The successful feasibility of the 'Pathways' approach now leads to a critical phase: the Proof of Concept (PoC). This phase aims to transition the approach from a controlled experiment to a practical, scalable, and commercially viable solution. Over the next 12 months, this PoC phase will be meticulously structured to ensure repeatability and effectiveness across various organisational contexts.

IASME, the delivery partner for this initiative, will spearhead the development of necessary structures, processes, and materials. Key activities during this phase include:

• Establishing participation criteria for Certification Bodies and Assessors.
• Developing pass/fail criteria for certification.
• Recruiting Certification Bodies to participate in the PoC.
• Creating guidance for both Certification Bodies and their clients.

Collaboration with Large Organizations

To robustly test and refine the 'Pathways' approach, up to 40 large organisations (with 250+ employees) will be recruited to participate in the PoC. These organizations will engage in a three-phase process:

1. Initial Assessment: A traditional Cyber Essentials self-assessment followed by Cyber Essentials Plus testing, resulting in either certification or a gap analysis.
2. Development of Additional Tests: Designing additional tests to validate the efficacy of alternative mitigations identified in the gap analysis.
3. Testing and Review: Conducting thorough testing and reviews to potentially achieve Cyber Essentials and Cyber Essentials Plus certification.

The cost and duration of this process will vary based on the specific needs and infrastructures of participating organisations. On average, the experiment phase required about 17 days of testing, moderation, and assessment, though actual times will vary.

How ProCheckUp Can Assist

As a CREST and CHECK accredited provider and IASME Cyber Essentials Assessor, ProCheckUp is ideally equipped to support organisations through the Cyber Essentials 'Pathways' PoC. Our expertise in penetration testing and red teaming ensures that we can rigorously test and validate your alternative controls, providing you with the confidence and assurance needed to achieve certification.

ProCheckUp’s involvement in this pioneering initiative underscores our commitment to advancing cybersecurity standards and helping organisations fortify their defences against evolving threats. By partnering with us, you gain access to unparalleled expertise and a collaborative approach tailored to meet your unique cybersecurity needs.

For more information on how ProCheckUp can assist your organisation with the Cyber Essentials 'Pathways' proof of concept, please get in touch:

Join us in shaping the future of cybersecurity certification and ensure your organisation is resilient against today’s cyber threats.

ProCheckUp, your partner in offensive cybersecurity, is ready to help you navigate the Cyber Essentials 'Pathways' approach with confidence and expertise. Reach out to us today to learn more about participating in this groundbreaking proof of concept.

?