Seeking Insights on IASME Cyber Essentials Certification Implementation and Best Practices
Has anyone recently undergone the IASME Cyber Essentials certification process? I am interested in detailed, real-world experiences with both the self-assessment option and the Cyber Essentials Plus variant, specifically in relation to technical controls, documentation requirements, and third-party auditor interactions.
Some points I’d like to discuss:
- How closely do the assessors scrutinize technical claims, particularly for endpoint security measures (such as application whitelisting, patch management cadence, and multi-factor authentication coverage)?
- What evidence or artifacts proved most valuable or challenging to gather during the assessment?
- Were there any unexpected difficulties with legacy systems, remote assets, or cloud services in meeting the requirements?
- Any recommendations for automation or continuous monitoring tools that simplified maintaining compliance?
Additionally, I would appreciate commentary on how successful certification has impacted clients’ or partners’ trust, and whether it has led to demonstrable business benefits.
Looking forward to a comprehensive exchange of experiences and expert opinions on ensuring an efficient and robust path to IASME Cyber Essentials compliance.