Background
Our client, a technology/engineering firm, recognised the growing importance of robust cyber security. Whilst they already had basic safeguards in place, they wanted formal certification under the UK’s Cyber Essentials and Cyber Essentials+ schemes to:
- Demonstrate to clients and regulators that they meet best-practice security standards in order to win contracts
- Identify and remediate hidden vulnerabilities before attackers could exploit them
- Establish a sustainable, future-proof approach to ongoing compliance
Challenges
- Unknown Vulnerabilities
The firm’s existing security posture had gaps—out-of-date software, inconsistent patching, and unmanaged devices. - Compliance Overhead
With a growing network of remote and in-office devices, manually tracking security settings and update status was becoming unmanageable. - Certification Complexity
Achieving Cyber Essentials+ requires a hands-on technical audit and rigorous evidence of ongoing controls, which can overwhelm internal resources.
Our Approach
1. Partnering with Predatech for Assessment
We engaged Predatech, an accredited Cyber Essentials assessor, to perform a full technical audit. This included:
- External vulnerability scanning
- Internal network and device testing
- Review of policies, procedures, and patching practices
2. Vulnerability Remediation & Future-Proofing
Based on the assessment report, we:
- Cleared existing vulnerabilities with targeted remediation tasks (configuration changes, OS and firmware updates).
- Developed a patch management schedule aligned to the client’s maintenance windows, ensuring monthly review and deployment of critical updates.
3. Deploying Microsoft Intune for Device Compliance
To streamline compliance, we implemented Microsoft Intune across all endpoints:
- Security Policy Enforcement: Enforced device encryption, firewall settings, and anti-malware configurations.
- Automated Compliance Reporting: Set up dashboards to flag non-compliant devices in real time.
- Centralised Software Updates: Configured Windows Update for Business policies to automate patch downloads and installations.
4. Integration of Best-of-Breed Security Tools
We supplemented Intune with:
- Multi-Factor Authentication (MFA): Rolling out MFA for all remote access and privileged accounts.
- Real-Time Threat Alerting: Integrating alerts from endpoint protection platforms into a central monitoring console.
Results
- Certification Achieved: The client passed both Cyber Essentials and Cyber Essentials+ assessments on first attempt.
- Zero Critical Vulnerabilities: All high-risk findings were remediated before the final audit.
- Streamlined Compliance: Automated patching and policy enforcement reduced manual effort by 75%.
- Ongoing Security Posture: Regular Intune-driven health checks ensure continuous adherence to standards.
Key Takeaways
- Proactive Assessments pinpoint risks before they escalate.
- Structured Patching Schedules are essential for staying ahead of emerging threats.
- Centralised Device Management transforms compliance from a chore into an automated workflow.
- Expert Partnerships (like Predatech) provide the credibility and technical rigour required for Cyber Essentials+.
Next Steps
If your organisation is aiming for Cyber Essentials certification—or looking to bolster its existing security framework—our team can guide you through every step:
- Initial Security Audit with an accredited assessor
- Tailored Remediation & Patching Plans
- Intune Deployment & Policy Automation
- Ongoing Monitoring & Support
Get in touch today to discover how we can turn your cyber security goals into reality—and keep you protected for the future!
