From Gap Assessment to Cyber Essentials Plus: A Year-Long Enterprise Security Transformation
The UK part of a large multinational energy organisation with a sizeable and complex enterprise technology estate.
A comprehensive gap assessment became the basis for a year-long remediation programme, internal investment and successful Cyber Essentials Plus certification with stronger BAU security practices.
Situation
A large multinational energy organisation wanted its UK operation to achieve Cyber Essentials Plus certification. With a sizeable and complex technology estate, the organisation needed to understand its current position, address significant gaps and establish sustainable practices before proceeding to formal assessment.
MDLabs supported the organisation from the initial Cyber Essentials gap assessment through remediation, readiness and eventual Cyber Essentials Plus certification.
Challenge and complexity
The initial gap assessment identified a significant number of areas requiring attention. Some could be resolved relatively quickly, while others required investment, technology changes and improvements to operational processes.
Proceeding directly to Cyber Essentials Plus would not have been appropriate. The organisation also needed independent evidence that could help security teams explain the issues internally, build a business case for remediation and secure the required budget across multiple stakeholders.
MDLabs approach
MDLabs provided clear gap assessment reporting that connected each issue to the Cyber Essentials requirements and set out the work needed to address it. The findings helped the organisation secure internal investment for the remediation programme.
Over approximately 12 months, MDLabs reviewed progress and helped relevant teams understand how the requirements applied to their environment. Particular focus was given to moving vulnerability management into Business as Usual and strengthening asset lifecycle management so unsupported technology could be identified and dealt with systematically rather than immediately before certification.
Outcome
After approximately a year of preparation, remediation and operational improvement, the organisation was ready for formal assessment and successfully achieved Cyber Essentials Plus certification.
The programme delivered more than a certificate. The organisation gained a clearer view of its Cyber Essentials posture, secured budget for necessary improvements, remediated significant gaps, strengthened vulnerability management, improved asset lifecycle management and embedded important activities into BAU operations.
The result was a more sustainable foundation for maintaining the Cyber Essentials controls after certification.
The client's identity has been withheld for confidentiality.