Why Jaguar Land Rover asked for it
Cyber Essentials is the UK government's baseline standard for protecting a business against common cyber attacks. There are two levels of Cyber Essentials. The basic certificate is a questionnaire about your setup, checked by an assessor. Cyber Essentials Plus adds a technical audit. An independent assessor tests a sample of your machines rather than taking your word for it.
Big manufacturers have started to include a Cyber Essentials certification in their supplier terms, so if you manufacture parts for another company, your PCs are part of their supply chain. A company would rather not take on the risk of a supplier's PCs being years behind on updates. So when JLR told ATD that Cyber Essentials Plus was now a condition of supply, it fitted a pattern we know well. A lot of the businesses who ring us about certification are ringing because a big customer asked.
What we did
Getting ready for a Plus assessment is mostly patient, unglamorous work. Every machine in scope has to be on supported software and fully patched, with malware protection on and a working firewall. Employees shouldn't be using an admin account for everyday work either. The assessor checks all of that, so preparation is key to ensure there's nothing for them to find.
Amar and Dan took it on. Over the course of around a month they logged on to ATD's PCs every day, working through security patches, software updates and checking each machine off against the Cyber Essentials standard. We've found that the daily rhythm matters on a job like this. Updates land, machines restart and something that passed today could need looking at again tomorrow. You only get through it by going back every day until every machine is clean.
Not every network plays ball. On some jobs you hit a machine that refuses an update, or software with no supported version left, and you've lost a week. ATD's network didn't do that - Amar and Dan said afterwards it was one of the smoother jobs they've done.
Cyber Essentials Plus for Automotive Trim Developments
What they do
Why
Result
Duration
