NCSC extends Cyber Essentials technical controls certification grace period
Image courtesy NSCS
In January, the NCSC announced an update of the Cyber Essentials technical controls. This move was part of a regular review of the scheme to ensure it keeps evolving as the threat landscape and technologies change.
That update was the biggest overhaul of the scheme’s technical controls since its launch in 2014. For this reason, NCSC recognised that some organisations might need to make extra efforts when assessed against the new standards and so offered a grace period of up to 12 months for three of the requirements:
- any thin clients included in the scope of certification must be supported and receiving security updates
- all unsupported software is either removed or segregated from scope via a sub-set
- all user accounts on cloud services are protected by multi-factor authentication (MFA)
This grace period was due to end in January. However, the decision has now been made to extend this grace period for a further three months until April 2023. This will coincide with the next, light touch, update to Cyber Essentials’ technical requirements.
The April 2023 update to the Cyber Essentials technical requirements will focus largely on a series of clarifications. It will, however, also include important new guidance:
- Clarification on firmware – All firmware is currently included in the definition of ‘software’, so must be kept up to date and supported. Due to difficulties with information provided by vendors, this is changing to just router and firewall firmware.
- Third party devices – Further information and a new table clarifying how third-party devices such as contractor or student devices should be treated in applications.
- Device unlocking – A change in this section to mitigate issues around some default settings in devices being unconfigurable. Where that is the case, it is acceptable for applicants to use those default settings.
- Malware protection – Anti-malware software will no longer need to be signature based and clarification has been added around which mechanism is suitable for different types of devices. Sandboxing is being removed as an option.
- Guidance on zero trust architecture in the context of achieving Cyber Essentials and a note on the importance of asset management.
NCSC will aim to announce the full update of the requirements in January, ahead of the go-live in April 2023.
