Comply or Cry:
Cyber Essentials

So, a quick hello from me. Let me make sure my slide moving is working. Oh, is it going to go? Here we go. Here we go. That'll do. I'll have to click. So, a quick hello from me. My name's Milo Sheppard. I'm on the Microsoft 365 team here at inforcer. My background is in MSPs. So, I spent seven or eight years working in technical roles in MSPs. Started on the help desk way back when. Worked my way up spending most of that time delivering Microsoft Modern Work projects.

So, things like SharePoint migrations, Intune rollouts, conditional access and Entra projects, that sort of thing. Used to do a little bit of Azure as well. I was quite involved with Azure Virtual Desktop. But these days focusing pretty solidly on Microsoft 365. Joined inforcer about eight months ago now and my job is to support our commercial and post-sales teams in making sure that what we're talking about at inforcer makes sense in the real world for MSPs.

So, really good to see so many of you here. We got 64 in today. Great turnout.

So, what is Cyber Essentials? Well, Cyber Essentials is a UK government-backed certification scheme that's designed to help organizations protect themselves against common cyber attacks. It defines a set of baseline security controls that every organization should implement to demonstrate a minimum standard of cyber hygiene, right? Cover covers five sort of main pillars which they put into technical controls. So, around firewalls and network ingress, egress devices, secure configuration, hardware and software, user access control to that hardware and software, malware protection.

So, specifically looking at things like endpoint security on our devices, but also in our cloud services. And patch management, right? So, making sure that of those devices and services that we're using that they're kept up to date and any critical or high level vulnerabilities are addressed in a timely fashion. And this is available to all organization types from small to medium enterprises and large enterprises and also their supply chains as well. So, you can see on the right the two sort of main people involved there.

So, this scheme is basically a directive of the National Cyber Security Centre, which is part of GCHQ. They own the scheme, but they have nominated IASME as their accreditation body. So, IASME are responsible for setting the controls and making sure the governance is kept on top of them. Now, underneath that you also may work with specific cyber security consultants that are specialists in Cyber Essentials. Some of you as MSPs may also be Cyber Essentials specialists yourselves and offering these services to your clients.

So, that's sort of how that structure sits there. Now, in Cyber Essentials we have two versions of it. We have the base assessment Cyber Essentials and we also have Cyber Essentials Plus. But what's the difference? Well, in Cyber Essentials we get a essentially the base level is a self assessment, right? It's a questionnaire that you or your customers have to run through to verify its own controls in those five sort of key technical areas.

All right? So, typically the base level of Cyber Essentials is lower cost and it's faster to achieve because it's a self assessment, right? You're not having any external auditor come in to verify any of these controls. It's a self sort of verified assessment. So this is great for organizations that are starting out on their sort of cyber security journey and want to get Cyber Essentials certified, right? It's a place that we all have to start.

The certification, if you pass it, is valid for 12 months, and the certification will then be verified by IASME. So you'll submit that self-assessment to IASME and so long as all the controls are within their boundaries of what they deem to be acceptable to pass the scheme or not, you'll then get a valid certificate for 12 months, and that has to be renewed every year. Now what do we get in Cyber Essentials Plus?

Well, Cyber Essentials Plus is a bit more of a sort of stricter requirement because we actually have to evidence and have somebody validate all of those things that we've put in our verified self-assessment. So Cyber Essentials, the base assessment is a prerequisite to Cyber Essentials Plus, so you need to do the verified self-assessment first. Once that verified self-assessment is done, you can then engage with a Cyber Essentials Plus auditor to come and make sure that you're doing what you say you're doing, right?

So this basically will run over a couple of days. You'll submit your verified self-assessment. They'll then come in and perform some manual and some automated checks on your environment to make sure that all of those controls are actually being adhered to. So that's a combination of things like vulnerability scans on your network but also configuration testing on site, so taking samples of devices and running tests against them to make sure that they are patched and up to date, they're using secure configuration and that they're up to that minimum level that Cyber Essentials deems necessary.

This basically gives a more I don't know, a sort of yeah, stronger assurance is probably the good word, right? It's a it's a it's a you know a sort of higher level of trust that you can put in a company that has Cyber Essentials Plus, because you know somebody's gone in and actually peeped behind the curtain and made sure that everything is looking as it should do, rather than just going through the self-assessment.

The self-assessment is definitely a great place to start, right? It I think initially it sort of gets you to sort of open the book on your own environment, have a look what's going on, and at least start to ask yourself some questions about what's going on and is there some bits I need to sort out before I submit that self-assessment there. And Cyber Essentials Plus is quite often required for some higher value government contracts.

So if you're if you work in the public sector at all or you're serving any businesses in the public sector where your customers are, this can sometimes be a requirement for some of those for some of those tenders.

So what are the five technical controls? If we've got any Yu-Gi-Oh fans in the house then you'll see I've got the five pieces of Exodia there. A bit of a niche reference, but some of you may get it. But I've got some hearts there. So what are we looking at? So firewalls and internet gateways is the first one. So making sure your boundary devices are configured to restrict inbound and outbound traffic correctly, but are also up to date.

We've got secure configuration of software and devices. So making sure you've not got unnecessary old software, making sure the software you do have is up to date. Any devices that you're using insecure default credentials are sorted. And any of your devices that you work on day to day, so laptops, mobile devices are configured in a secure manner. So making sure that they've got things like encryption enabled and they're not configured with insecure protocols like old versions of SMB for example.

Then there's user access controls, right? So that's looking at the specific user accounts that are involved with you working day to day, right? So making sure you're using principles like least privilege, and you've got good approval processes for your change management, but also making sure that you're using individual accounts for each person. You're not sharing accounts, and that there are things like separate admin accounts separate to your day-to-day accounts, so that there's not a potential overlap there, and you're not going to cause yourself a mischief by using an admin account to read your emails or access teams day-to-day.

There's also some bits around authentication to your on-premise services and cloud services as well. So things like requiring MFA and making sure you're using strong authentication methods. Then there's malware protection. So this is really thinking about how we protecting our devices and our services from malware. So for devices, very simple. It's thinking about have we got good controls in place for things like antivirus and endpoint detection and response. And for our cloud services, it's thinking about things like our email protection gateways and our other mail protection services, things like Defender for Office 365, protecting teams for example, things like safe links, safe attachments.

So making sure that those sort of real-time scans are being done on inbound and outbound communications and data. And then finally is patch management. So keeping all of our software up to date, keeping all of our operating systems up to date, keeping our devices up to date that are on the network. So this could be you know things like your switches and your firewalls, also like servers, and also could be as simple as something like a Teams room device.

If it has an operating system on it that can be configured and is on the network and it can be updated then needs to be kept up to date. But also things like Windows patching as well. So making sure that just like the firmware is patched, but also the software running on it is patched as well. So those are the sort of five key areas that are measured during a Cyber Essentials assessment.

So inforcer is a company that deals pretty solidly with Microsoft 365. So how does this link in with Microsoft 365? Well, Microsoft 365 falls under the cloud services scope. So in your Cyber Essentials assessment you have to define any cloud services that you're interacting with. Now cloud services could be a range of things and most recently we'll talk about some of the new changes in Cyber Essentials with the most recent update a few days ago.

But that could be something as simple as social media accounts that you use as part of your business. So think things like LinkedIn, Facebook, you know, X pages, those sorts of things. You know, those are in scope of the cloud services that you're operating within your business. So Microsoft 365 and all its data is in scope, but also Microsoft 365 for a lot of you and for a lot of your customers will also be handling a lot of infrastructure elements as well.

So think about things like identity, right? You know, access to different resources, our email, but also our endpoint management as well. So we're looking at things like Intune and Autopilot and you know, SharePoint for our data, right? So all of those things aren't necessarily a cloud service, but you know, typically considered infrastructure. They might have previously been managed by your on-premise servers and now in scope with Microsoft 365 because now Microsoft 365 is handling those things.

You also might be using single sign-on like SAML authentication to use your Microsoft 365 identity to log into other services as well. So that sort of brings that into scope as well and I can talk a little bit later about how that can actually work as a benefit to you to make your Cyber Essentials audit a little easier. And you know, if you're using your Microsoft sorry into those cloud services rather than using their native authentication actually makes it a lot easier for you to conditional access to make it mandatory for your users to sign in with a compliant device that's registered within Intune.

And Defender for Endpoint. So this is things like malware protection and threat detection, right? We've got that in Business Premium. Maybe you're using a third-party solution like a Bitdefender or a SentinelOne to offer that for you and your customers. But that's sort of in scope as well if you're using the Defender suite there. BitLocker, you know, if we've got BitLocker as a requirement as part of our Intune configuration for hardening the devices, that can be configured in Intune as well as other device configurations as well for things like, you know, like restricting USB key access and blocking, you know, old SMB protocols and things like that.

So that's that sort of covered under that infrastructure section as well at Intune. And we've got Defender for Office 365 and Exchange Online as well. So that's the ingress and egress of communications and data with email and you know, things like safe links, safe attachments that we get with Defender for Office 365. Also just our Exchange Online policies for things like you know, anti-phishing etc. So that's kind of the areas where Cyber Essentials touches Microsoft 365 and where those bits are relevant, right?

What are some of the other areas though? Well, some typical examples here would be around your sort of existing network and infrastructure, right? So the boundaries and the firewalls, you know, whether you're using a firewall or a separate VPN device, those are all in scope. Other sort of network devices, so this could be like, you know, other you know, other routers you're using or switches that have like default passwords. It looks at things like network segmentation, right?

So if you're using if you have to have old older sort of devices, I'm looking mostly at the MSPs with manufacturing customers, you'll probably know what I'm talking about here, making sure that any old legacy devices are sectioned off on a separate network that's out of scope there. And other things, you know, other physical network appliances like the sort of meeting room devices I was talking about and your Wi-Fi networks and things like that.

But also we've got things like data and devices and then other third-party bits of software, right? So personal devices that have access to your company data will be in scope if they're you know. So for people that are using their personal mobile phones to access emails or Microsoft Teams, those ones are going to be in scope now and something you're going to have to keep on top of. So something to think about when you're taking a customer through Cyber Essentials.

Maybe there's some other sort of products you might want to think about beforehand, you know, if it's going to be easier for that customer to manage mobile devices. If they're all corporately managed, maybe that's something they need to think about first. So all food for thought there. And other things, third-party software is included there. So this is not just you know your Windows patches, your security updates. This is also other software you have on your devices.

So things like you know your third-party browsers, things like Google Chrome being out of date, that could potentially be a problem. You know Adobe PDF reader, if you're using an old version of that's potentially got a security vulnerability, that's going to be in scope and we need to make sure any critical security patches are being kept on top of those as well. And obviously any other cloud services that are using beyond 365.

So I talked a little bit about how you might be using Microsoft 365 to single sign on to those other services. So you're just using one email address, password and MFA method. So you're not having to maintain multiple different MFA methods and multiple passwords, right? That can be great, but those other services are still are still potentially in scope. And a couple of other things as well like there's some physical access controls for like your server and network equipment, right?

So making sure that all your network and server equipment is you know either in a locked cabinet or in a locked server room, right? So a couple of other controls there that you'll see in the self-assessment. And quick question from Patrick there. He's asked how is app protection for BYOD considered with Cyber Essentials? App protection is something that you'd use to make sure that you are securing that data, right? You know, we know with BYOD devices on mobile devices, it can be a little tricky to manage that data.

So app protection policies are a great way to make sure that we've got control of what's going on there. But for those devices as well, those devices also need to be on, you know, things like the correct firmware. So when they're registered with Azure, I was just going to say Azure AD, going back in time a bit there, when they're registered with Entra ID, we still get information on, you know, sort of what firmware level they're on.

So if your iPhone's on a on an out-of-date version, that will still need to be updated even if it's not a you know, a corporately owned device as well. So some interesting things to consider there. App protection definitely helps protect that data, but yeah, still some other things that you have to consider there that you might not have physical control of. Yep, set minimum OS version on app protection. Yeah, absolutely. So you can put some controls in place to make sure that if they are out of date, that you're not allowing access to that data.

But yeah, we still need to make sure that they're kept on top of and they're and they're being audited as part of the assessment if they're accessing your company data. Super.

So why should MSPs care about Cyber Essentials? Well, I think one of the ones I always talk about is, you know, cyber insurance firms are now looking for Cyber Essentials as a marker of good cyber hygiene. And I'll talk a little bit about cyber insurance a little later on in the slide because if you're if you're a younger company or maybe a smaller MSP, cyber insurance might be a new conversation for some of your customers.

So there's some areas where Cyber Essentials can help there, but yeah, it is being used as a marker for good cyber hygiene. So when you're you yourself are going for those cyber insurance renewals and the liability renewals, that can be used as a consideration when deciding how much you're paying for your premiums. UK government contracts are requiring Cyber Essentials certifications from suppliers now. So, whether it's you or your customers are going for government contracts and you're bidding for those tenders, more often than not that's going to be an absolute requirement for those areas.

But also we're starting to see more and more private sector tenders start to have Cyber Essentials as a requirement for the for the businesses that they're doing business with. So, in when you submit your RFP or sorry when they put out their RFP a lot of the times that would be a hard requirement in there. So, we're starting to see more and more of those out in the MSPs that we're speaking with and their customers.

And yeah look ultimately that non-compliance with Cyber Essentials does risk not just you as MSPs but also your customers potentially losing business if they can't if they can't meet that requirement for those bids. And Cyber Essentials you know it kind of sets you apart from other MSPs you know in your competitive area that don't have Cyber Essentials, right? I think it's a good trust mark that people are starting to recognize more and more in the UK.

So, if you're if you're go going to battle with another MSP to win some business and you've got CE Plus and they don't have Cyber Essentials at all that puts you in a really good stead and it's something you can shout about. And when you go through your assessment IASME will also give you some nice sort of media bits for you to put on your website, some nice badges in your email footer, some things like that to be proud with your customers and your prospects about the fact that you are Cyber Essentials compliant and you can potentially also offer it as a service.

What it also offers well is an opportunity for MSPs to think about some new revenue opportunities, right? So, a lot of you will all already be offering Cyber Essentials for your customers today. And typically the way we've seen that happen is in, you know, yearly projects, right? You know, Cyber Essentials renewal is coming around, so we'll sell a project to be able to make sure that they're going to pass their assessment, right?

And that can you know, that's that has worked for a long time. It can sometimes be a tricky conversation, especially if that budget is not always planned for, right? Things change, business needs change, and your customers may not always have the cash available to go, yeah, I'm going to go for this Cyber Essentials project. So, we've got an opportunity now to think about how we can make that into more of like an ongoing service, make it a little bit more easier for your customers to manage financially in a sort of monthly recurring type of service, which you know, is what we're doing as MSPs is it's kind of where we want to move to.

We want to move as much as we can into those sort of monthly recurring managed services rather than point in time projects or, you know, sort of time and materials type based stuff. And so been able to add that as a sort of feather in your cap as an MSP is a is definitely a value add. The other thing which I think is quite often forgotten and actually I have to say as I was preparing for this, it's been a little while since I've done a Cyber Essentials review for a customer.

And so IASME gives you the opportunity to opt in to free cyber liability insurance provided by them if you are meeting some certain criteria. So, if you're a UK-based organization with a turnover of under 20 million and you achieve your Cyber Essentials certification, you're entitled to free cyber liability insurance arranged by IASME and you get a 24-hour helpline to report any cyber incidents and you'll get crisis management and incident responses as part of that with a total liability limit of up to 25 grand.

So, for small businesses that don't currently have cyber insurance, this can be a real big sort of value add and a big selling opportunity, right? You know, you know, if you're able to deliver Cyber Essentials, the cost of going through that evaluation and that project gives you a sort of bit of a financial cushion, right? In that in that sort of 25 grand of liability insurance. So a real sort of value add when you're talking about it with your customers as well.

As MSPs, you might argue that 25 grand might not be sufficient to cover all of your customers. So maybe look into some extra policies there, but I'm certainly not an insurance advisor. So speak with your insurance provider and certainly seek advice from them rather than me. Good with technical, less so much with legal. Okay.

So let's talk a little bit about the changes. This is kind of timely, right? Cuz in the last three days, April the 27th, IASME released a new version of their controls and they give them different names. The last year's one was called Willow. This is now called Danzell and this is version 3.3 of their sort of questionnaire and controls. So what are some key changes here? So well, the first one is the name obviously.

So Danzell replaces Willow as the new code name for the question set. A lot of the questions have been reworded for better clarity and to remove some of that ambiguity. I think if anyone's gone through Cyber Essentials already, and they know some of the questions could be sort of open for interpretation a little bit. And quite often when I was doing these assessments in an MSP, I'd have to go back to IASME and sort of get some clarification on exactly where a customer might sit based on their response.

So they've recognized that and tried to tidy up some of that wording so it's a lot clearer about how you should answer it and where each of your customers will sit when they're going through their assessment. Some questions have also been moved around and restructured to sort of sit in the right place. So if you've gone through a Cyber Essentials assessment either yourself or with your customers and from the last year's one with Willow, some of those questions might not map directly to the new ones, so definitely worth a sort of closer look as you're going through and these after on or after April the 27th there.

And there's some tighter scoping requirements, so there's sort of clearer and stricter rules now put in place on defining the scope of the certification. So first of all that sort of is immediately important around the network segmentation. So you need to be very clear and also give justification for any items that are out of scope or networks that are out of scope. For example, if you've got legacy system that's on a segmented network, you've got to give a bit of a better explanation as to why that's segmented and the real reason behind that rather than just saying this is segmented out of scope because it's legacy, right?

There needs to be a bit better justification there. Also around organizational structure. This is quite important if you are part of a wider group or your owned or your customers are owned by a sort of bigger business. Typically you say the whole organization is a sort of a quote when you're when you're answering the assessment, right? And there'll be some options that say, you know, does the whole organization meet this requirement? Now you've got to be very careful about what the whole organization includes.

If your organization specifically is part of a bigger group and you say the whole organization, that's not necessarily true, right? Because the whole organization could be your whole group. So you need to make sure that you're clear about that it's just for my organization as part of a wider group so they know exactly what that's covering. I think there were some issues before where they were saying the whole organization and only one sort of arm of the larger group was sort of getting everyone in the organization covered, which obviously isn't correct because there's a lot of stuff that they don't have visibility or purview also any test or development environments, this is more for the sort of people that are developing software need to be excluded and segregated if they're not meeting the requirements.

So typically that's written out of scope but yes some more sort of structured wording around those in the questions this time around. For cloud services there's a new sort of definition there. They've basically improved the wording to make sure that the definition makes a little bit more sense. So that includes the specifics around things like social media accounts for business, so Facebook, LinkedIn, Instagram, that sort of thing. And cloud services cannot be excluded from the scope now.

So if you use a cloud service as part of your business that has to be in scope. Mandatory MFA now for all cloud services where it's technically available. So if you do have a cloud service that doesn't support MFA and I'd argue there's probably very little cloud services that don't have MFA these days. I know there are some but where there is MFA available for these services it must be enabled even if you're on a current tier that doesn't support it.

So for example if you're on a free tier of a service that doesn't support MFA you will now be liable for the cost of the paid service that does include MFA otherwise that will not be compliant. There's also some other bits around conditional access and how that works with MFA. Before we were able to use things like trusted IP addresses to be considered multi-factor authentication. Now that's not allowed. We can't use allowed IP addresses to meet that need and we're going to have to use other methods like passkeys or compliant devices to sort of meet that requirement there.

There's also a few new automatic fail questions. These specifically come around patching. So A6.4 and A6.5 which basically talk about the sort of high risk and critical security vulnerabilities that need to be patched within 14 days of them being released. If it if that's not being adhered to that is now an automatic fail so something to work out to watch out for. And failing those questions will now result in yeah like a an immediate failure of the whole self-assessment right so there's no allowance for any major non-compliances in those areas anymore.

Around the user access control enhancements we've got some new literature in the assessment around passwordless authentication. So specifically looking at things like passkeys you know FIDO2 approved authentication methods this is now explicitly accepted as an equivalent to traditional MFA. So previously if you were using like passwordless methods like FIDO2 key to log in technically we've always known that's MFA but it wasn't necessarily clear that it was actually like approved and it there was a bit of a gray area now so now it's been officially recognized passkeys and passwordless authentication as a as an appropriate method of MFA.

So we're thinking things like you know Windows Hello for business and been able to use face ID or your fingerprint because it's something you are and something you have i.e the TPM chip in your device like that counts as MFA. We've got stronger emphasis on proper user provisioning regular access reviews least privilege so really making sure we're having clear guidance around users not sharing accounts and separation of admin accounts and standard user accounts.

And then in the application development this used to be called web applications they've now renamed this section to application development and this is updated in line with UK government's software security code of practice to be called development now. So again, mostly for those shops that are also developing some sort of software around the services they offer. Not typically in scope of MSPs, but some of you might be offering business solutions.

So you still get with a few MSPs that offer things like Business Central for example and we create sort of custom code and extensions around that. So it kind of fits into that niche there. Okay, moving on then.

So the Cyber Essentials Plus changes they now have a new requirement for devices particularly around the patching, right? And they will require a second sample of testing devices if the initial sample test fails. So for example, if there's any non-compliance for any devices are found in the first technical sample, the organization will need to basically make sure that they're remediating this across the entire estate and not just the sample devices, right?

We need to be able to evidence that. And rather than just retesting those devices, the original devices and the second sample set will then be included in the retesting. So you know, you can't just fix those devices and then have it pass, right? They're going to include a whole new sample set. So that's a pretty major change in these in this new version here. And failure on the second sample set will not just result in a failure for CE Plus, but also could have implications for your self-assessment of Cyber Essentials and that could actually be revoked if that second sample set fails.

So actually you know, pretty huge change there and a pretty huge implication. Again, really trying to drive and make sure that we're covering all of those devices properly and we're really being able to evidence that across the across the estate there. Next if the Cyber Essentials Plus there can be no changes to your verified self-assessment once the testing begins. So once you've done your Cyber Essentials base and your VSA has been submitted, no changes could be made to the self-assessment.

Seems like a bit of a no-brainer and most auditors, third-party auditors that you've worked with typically wouldn't let you change that anyway, but there've been some instances I've had where some people were trying to change some things as they're going into Cyber Essentials, plus probably for the wrong reasons, right? Probably because they realized there were some bits that they weren't quite doing that they needed to go and fix and or people were doing things like, you know, changing company names and stuff like that.

So make sure when you're doing a verified self-assessment and you're thinking about going for Cyber Essentials Plus or even if you're not thinking about going for Cyber Essentials Plus, but it might be something you go for in the future, just make sure your VSA is honest and submitted with the correct information. And there was also some updated clarification around the point in time assessment. Now this basically says that the point in time of the assessment is not actually necessarily when the assessment initial assessment takes place, but it's when your Cyber Essentials certificate is issued.

Now this is important specifically around things like end of life applications and end of life devices. So think back to last year or the year before, I can't remember quite when it was now, but when Windows 10 went end of life, right? If somebody started their Cyber Essentials certification before that end of life date, you know, in theory their devices would still be supported, but when their certificate was issued and if that was after the date, you know, they'd suddenly no longer be in compliance.

So the clarification is to say that all things must be prim and proper, correct, and compliant at the date the certificate is issued, so at the end of the assessment. So yeah, if you know that there's some end of life dates coming and your assessment completion is likely to be after one of those end of life dates, make sure you're accounting for that and you've got those devices either up to date or replaced with supported software or hardware.

Super. So that covers some of the changes there. There were some other notable changes. The requirements document updates from version 3.2 to 3.3. So, that's the sort of version number behind those sort of code names there. And the transition period basically for any assessments that started on or after the 27th of April 2026 will be subject to the new regulations if you like. And if you started an assessment before the 27th of April, you're still subject to the old ones.

So, these changes won't be relevant to you today, but will be relevant for your next assessment. And anyone that's doing a current assessment that started before the 27th of April must be completed before October for it to still be valid. Otherwise, you'll have to restart and go through the regulations there, the new version of the regulations. Right, lots of information there.

So, let's tie it into how inforcer can help with that now. This is an inforcer webinar after all. So, you know, we talked about the areas when Cyber Essentials touches Microsoft 365 or Microsoft 365 is in scope of Cyber Essentials. So, how can we help with this? Well, inforcer basically looks to help standardize and automate and evidence your security posture across your business and across your not just your Microsoft 365 environment, but obviously all of your customers as well.

So, we help with things like drift detection. So, you know, we can align your customers with a Cyber Essentials baseline. And we actually have a Cyber Essentials baseline within inforcer as like a pre-made sort of baseline that already has a lot of the controls in place that support Cyber Essentials compliance for those areas of Microsoft 365 that are in scope. And with the tool, you can monitor drift. So, if we're if we're thinking about you know, moving to more of a service-based model for Cyber Essentials, right?

You know, thinking about how we can keep on top of that over the year as part of a monthly service rather than having to do a point in time project and a last-minute rush to get everything over the line before the assessment date. We want to be able to you know alert on those things as time goes on and just slot them back into place where they need to, right? This means there's not a mad dash when it comes to assessment date.

We know if they've been if we've been keeping on top of this over the year for a customer when assessment date comes around we can say we're compliant, we know we're compliant, we've been delivering reports to the customer to prove their compliant and it makes assessment day a lot more of a stress-free ordeal, right? And we talked about some of the evidence. So as part of that monthly service you could send reports on how well compliant they are, right?

You know what is their alignment score with your Cyber Essentials baseline that you're offering them and be able to let them know if there's any controls blocking that or any things that they need to do so that you can get that back aligned. And we talked about the baseline alignment there. So this can be an addition to for those customers that are already with inforcer and using inforcer to align their security or just not just their security but just configuration in other areas of Microsoft 365.

This can be like a service laid on top of that. So you might have your core Microsoft 365 managed baseline but also like a Cyber Essentials baseline on top of that. So that's where you can use inforcer to help deliver this sort of monthly Cyber Essentials managed service to your customers in an ongoing fashion, right? And obviously inforcer the main problem we're looking to solve is the multi-tenant aspect, right? We know that managing Microsoft 365 day-to-day individually for all of your customers is a real pain, right?

It's lots of manual effort to keep all these policies up to date and to be able to have the visibility of when things change, right? So just being able to manage that in one pane of glass across all your customers, keep things up to date easy, reduce the load on your engineering staff so that they can maybe offer more of these services and you can offer more of these services as your business to more customers with the same amount of resource is a real value add.

Coming soon as well, I don't like to talk too much about roadmap but I think this is important one to touch on because it kind of makes sense in this context, right? We've released new scheduling features in inforcer that's also going to us to do automatic remediations as well. So, if any of these settings that are aligned with the Cyber Essentials baseline change within your customers' environments, we can automatically set them back. So, actually removing the need to do any manual remediation by our inforcer.

We can just know we've set these policies to auto-remediate and we know that always going to be in line even if somebody tries to change them. So, that could be a very hands-off approach to be able to make ensure that your customers are already compliant from a Microsoft 365 perspective when it comes around to assessment date. Fantastic.

So, that brings us to the end of my slide. I hope that was useful for you guys. Hopefully it sort of paints a bit of a picture about why Cyber Essentials is important and why you should be thinking about not just for yourselves but also for your customers and how you can think about how you can maybe shift from more of a project-based implementation of Cyber Essentials to a more service-based implementation and how you can potentially use inforcer to help deliver that to your customers and cover off all those areas from a Microsoft 365 perspective.

Happy to take any questions at this point. So, if you got any questions, feel free to throw them in the chat. We've got some time here now I can answer those. I can't see anything in the Q&A section but I'll look in the chat here. Ryan asks does that Cyber Security baseline exist today? Yes it does. So, within inforcer we have a Cyber Essentials baseline that you can subscribe to. So you can sort of add that as an extra layer on top of your existing baseline if you got one within inforcer.

Or if it's if you're new to inforcer that can be a standalone maybe first offering for you and then you can use some of our other baselines to help cover some of the other areas of Microsoft 365 that aren't necessarily in scope of Cyber Essentials but we still want to keep on top of and manage for our customers. Yeah, great question Ryan. Is there a Cyber Essentials report to run the tenant against? Yeah, very good question Luke.

So when you when you're measuring your customers against any baseline in inforcer, you can generate a tenant alignment report. And so that'll basically tell you how well aligned they are to that specific baseline. So if I just jump back to this previous slide, you'll see here we've got a nice view in the portal of what's unacceptable, what's recommended from the baseline, so stuff the customer doesn't have yet, and also all the aligned policies.

And you'll see we've got a little alignment score at the top there. This is all exportable into a nice report. So when you first measure your customer against the Cyber Essentials baseline, they probably won't have or they may not have the best score to start with, right? It might be a 30% or something like that alignment to start with. So you can run that report initially to say, right, this is the this is where we're starting and we want to get you up to 100% alignment with our Cyber Essentials baseline here.

Then obviously you can take them on a bit of a journey as part of that ongoing service. Maybe you do a little bit each month to increase their alignment score with a view to get them up to 100% before their renewal date. After their renewal date comes, right, then it's just a case of topping things up with just getting alerts when things fall out of line, whether it's somebody on the help desk that's, you know, making a quick troubleshooting change and forget to change something back.

inforcer will catch that and allow you to easily remediate that to bring them back in line so you can just keep on top of that. Can you see how aligned they are to the Cyber Essentials baseline without applying the policies? Yep, absolutely. So measuring your customers against that Cyber Essentials baseline doesn't actually push out any policies, you know, when we put them in what we call a baseline group there, all it's going to do is assess them against that baseline, right?

We're not going to push out any policies automatically unless you specifically ask inforcer to do so. So that's that like initial assessment I was talking about. Maybe when you first measure them against that baseline, they may already have a few things in there now and they're at 30%. So that could be just an initial report. I haven't pushed out any policies to them yet. I'm just getting a measurement of where they sit and then we can start to plan where those remediations are going to take place and what the impact to the customer might be.

Next question: can we run this for prospects, clients not yet in inforcer? No. So, the baseline alignment can't be run today. They would need to be a full inforcer customer or a full tenant within inforcer to be able to measure against a baseline. We do have a tenant assessment SKU in inforcer and we're looking to add a Cyber Essentials assessment to that and that would allow you to onboard a prospect and from a read-only perspective run that initial assessment.

Obviously that's not against the baseline right, so we can't start pushing out policies for them then. They'd have to be an inforcer customer for you to then actually push the policies using the tool. But that is something we're looking to bring into the assessment section of the tool in the near future here. Zephyrs asked with Cyber Essentials Plus now including second sample testing and strict validation, what has changed most in how organizations should prepare?

I think really what it's shown is that organizations need to have a better view of you know where their devices actually sit, right? I know there was you know some businesses in times gone by have been like oh you know I've got my sample of devices I've given them and if they failed I've just been able to patch up those devices and that's part of the assessment. Now that we've got that second sample, it's just super important that we're actually doing this stuff properly across our whole estate and it's just a more of a sort of hit home for businesses that we need to have a real good view and visibility of all our assets and making sure the assets are all in our systems in our RMM in Intune so that we can get that information know if they're patched know if they're not.

So I think it's just IASME saying you know there's been some there's been some you know sort of lighter auditing controls on that so they're just making a bit stricter to make it mean a little bit more. So, I think just making sure the people are you doing what they say they do not just across the sampled devices but across the whole of the estate. So just makes it more difficult to get away with how heavy on the Defender front is the baseline.

Majority of our clients don't use Defender. Good question. We do have some Defender policies in there but you don't have to include them. The nice thing about inforcer is you can copy policies from our Cyber Essentials baseline into your own baseline tenant and then sort of create your own baseline from that right? So you can if you didn't want to include the Defender policies you could just create what's called a partial baseline and only select the policies that are relevant to stuff in Microsoft 365 that is in scope for your customers.

So if you're using third-party mail filtering or third-party AV you can absolutely exclude those or you can also do what we call an accepted deviation which is where even if the policy's being measured we can say you know accepted via a third party similar to how you do it in Microsoft secure score. Ian asks Cyber Essentials plus if the first batch of devices scanned for vulnerabilities identifies issues the assessor will ask to scan a second batch of devices.

Is it an automatic fail if the second scan identifies the same vulnerabilities or is there an opportunity to resolve the vulnerabilities on the second batch before a fail is issued? Very good question. My understanding is that you will still get the opportunity to remediate it that but it just means if you if on your second batch you still aren't able to demonstrate that those are remediated then that's going to be a fail. So you know I probably would check IASME's exact instructions on that one and I've got a couple of resources to share just to show you exactly what the changes are.

So if I skip back a few slides here I've got some links that I can share with you guys around some of this stuff. Let me have a look. I have to go back to my PowerPoint because it doesn't seem to have updated my notes here. Let's see if I can pull some of these through. Let's see new changes. Here we go lovely. So I'll link this one in the chat here. So this is a link to where it shows you the differences between the old Willow checks and the new Danzell checks so you can go in there and have a look at the specific wording and see exactly what the requirements in there.

It will show you what the old changes were, what the new changes were and how exactly they differ. So definitely go and download that little Excel sheet there and it will give you exactly what the differences are between the old and the new checks there. Also I wanted to share this one as well for anyone that is was interested about the information around the around the cyber insurance that IASME offers.

There is a link here that you can direct yourself to or your customers to have a little look at and see exactly what the eligibility requirements are there. We've got time for a few more questions in here. Jonathan asks for Cyber Essentials baseline and the reports run from it. If we are deploying our own policies that comply with Cyber Essentials and Cyber Essentials Plus, is there a risk that tenants would have a low alignment score on this or would it be able to detect whether policies are achieving the same or better effect?

Yeah, really great question. What we can do within the baselines is we can actually see similar policies. So when there's a policy that's recommended from the baseline, so if we look back you can see we've got a recommended from baseline. If that thinks it's a net new policy but the customers already got a policy in there, we'll do some similar policy scanning. So if we can see there's a policy match, we'll light that up and then you might want to rename that to the Cyber Essentials baseline so that you get a good compliance score in the Cyber Essentials one and then maybe accept it as a deviation in your other baseline to say right that's you know we renamed that to our Cyber Essentials policy name or if you want to you can customize it so you can pull all those Cyber Essentials policies into your own baseline tenant and rename it so that it aligns with your existing baseline as well So a couple of different options there.

You can do it either way, but we do some similar policy scanning so that you can see where those similarities are, so you're not doubling up on work. Lovely. I think that is all the questions here today. Thanks Jonathan, and thanks everybody else for joining. It's been a really great session. I will move to this last slide here. If you want to learn more about inforcer you can go over to inforcer.com. You've got the opportunity to either book a demo with us or you can watch one of our demonstrations with our co-founder Will.

You can email us, hello at inforcer.com, or find us on LinkedIn under inforcer. Thanks everybody for your time today, and look forward to seeing you in the next session. Take care.