How the Cyber Essentials Changes Affect Your Business

Home Workers

The Cyber Essentials requirements for home working have been updated to include remote working. This change reflects the modern need to work within untrusted networks, such as cafes and hotels. The Cyber Essentials standard covers all devices used for your organisation’s business activities, including both company-provided devices and personal devices (BYOD) used for work purposes. Additionally, if your organisation supplies a router to a home or remote employee, that router is also included in the scope.

Network Equipment

Applicants are now advised to list only relevant network equipment, avoiding unnecessary items like hubs and switches.

According to the new update organisations must provide a list of network equipment in scope for this assessment. Include the make and model of each device. List all equipment that controls data flow to and from the internet, such as routers and firewalls.

Passwordless Authentication

While the update in 2022 mandated the use of multi-factor authentication for all accounts, the new version will accept logging in without a password if it follows approved methods like biometric authentication, security keys or tokens, one-time codes, QR codes and push notifications. More guidance is available on the NCSC’s website.

The following questions can now be answered in terms of passwordless authentication:

• How is your firewall password configured?
• If you run or host external services that provide access to data (that shouldn’t be public) to users across the internet, which authentication option do you use?
• Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?

Security Updates

In the 2025 Cyber Essentials update the software definition includes the term ‘extensions’ for improved accuracy in place of the term ‘plugins’.

You must ensure that all installed software is correctly licensed, accommodating modern licensing agreements where software is supported only if licensed appropriately. Additionally, software updates must now include configuration changes and/or registry fixes, if instructed by the vendor, to mitigate high-risk vulnerabilities.

Vulnerability Fix

In the context of Cyber Essentials, a vulnerability fix is a crucial part of security update management. It involves identifying and correcting potential weaknesses in devices and software systems. This proactive approach ensures that known security issues, for which fixes are available, are promptly addressed to protect against potential cyber threats.

In the Cyber Essentials requirements document, the description that used to be ‘patches and updates’ will be changed to ‘vulnerability fixes’ as an umbrella term for all the different methods. Vulnerability fixes include patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.