Cyber Essentials Plus.

An external vulnerability scan will be taken on external-facing IP addresses to the organisation. All TCP and UDP ports will be scanned to look for vulnerabilities within this test.

An authenticated internal vulnerability scan will be conducted on a sample set of systems to review for vulnerabilities. This scan will review patch management highlighting vulnerabilities across systems. Any vulnerabilities identified with a patch that has been released for more than 14 days will result in a failure of this test.

A review of end-user devices malware protection will be conducted to ensure that all antivirus is up to date and active. This also applies to mobile and tablet devices, where phones may be checked for code signing to ensure devices aren’t jailbroken or rooted.

A set of emails will be sent to a sample set of end-user devices containing either malicious attachments or malicious hyperlinks to test the efficacy of email protection. This test must be undertaken on a standard non-administrative account.

Each of the end-user devices within the sample set will be required to navigate via each web browser to a website hosted by OmniCyber Security. This website will contain a set of specially crafted virus test files to validate the functionality of malware protection on the web browsers in scope. The malware attached won’t affect the organisation, however, it will flag to the assessor if the antimalware protection measures are sufficient to meet the Cyber Essentials standard.

For any cloud enabled services relevant to the assessment, an OmniCyber Security assessor will review the multi-factor authentication to ensure it is enabled appropriately according to the Cyber Essentials Plus standard.

To ensure user privileges are aligned to the Cyber Essentials standard, user accounts will be reviewed to ensure that administrative accounts are separate to day-to-day user accounts.