NCSC Cyber Essentials Plus Data Sheet February 2023

NCSC Cyber
Essentials Plus
Alignment with Forescout

Cyber Essentials:

Requirements for IT
infrastructure

The Cyber Essentials certification scheme from the National Cyber Security
Center (NCSC) helps you to guard your organisation against cyberattack.
It’s a simple but effective government-backed scheme that will help you
protect your organisation, whatever its size, against a whole range ofthe most common cyberattacks. Cyber Essentials Plus uses the same
framework, guidance and protections but requires a hands-on technicalverification rather than a self-assessment.1

How Forescout helps
v2.2
April 2021

© Crown Copyright 2021

The Forescout® Platform continuously automates cyber security acrossyour environment. Key capabilities that align with Cyber Essentials
Plus include:▶ Real-time discovery of all IP-connected devices▶ Continuous assessment of security risk posture by device classification▶ Complete and context-rich asset inventory across the entire enterprise▶ Automated software updates, patch management and incident response

Key Components and Scope of Cyber Essentials PlusCOMPONENTFirewalls

OBJECTIVE
Ensure that only safe and necessary network services can beaccessed from the Internet.
Boundary firewalls should be supported by network controls(ACLs) and host-based firewall solutions.

APPLIES TO:▶ Boundary firewalls▶ Desktops▶ Laptops▶ Servers

Secure Configuration

Ensure that computers and network devices are properlyconfigured to reduce the level of inherent vulnerabilities andprovide only the services required to fulfil their role.

▶ Application servers▶ Infrastructure services▶ Desktops, laptops▶ Network infrastructure▶ Mobiles and tablets

User Access Control

Ensure user accounts are assigned to authorised individuals onlyand provide access to only those applications, computers andnetworks actually required for the user to perform their role.

▶ Application servers▶ Infrastructure services▶ Desktops, laptops▶ Network infrastructure▶ Mobiles and tablets

Malware Protection

Restrict execution of known malware and untrusted software,to prevent harmful code from causing damage or accessing
sensitive data.

▶ Desktops▶ Laptops▶ Mobile phones▶ Tablets

Ensure that devices and software are not vulnerable to known
security issues for which fixes are available.

▶ Application servers▶ Infrastructure services▶ Desktops, laptops▶ Network infrastructure▶ Mobiles and tablets

Security Update
Management1

NCSC Cyber Essentials Plus Data Sheet February 2023

FORESCOUT PLATFORMCOMPONENTFUNCTIONALITY

BUSINESS VALUE▶ Assess all devices to ensure a suitable host-based firewall is installedand functioning.
▶ Check and report on all running services and installed softwarefor desktop, laptop and servers.

Firewalls▶ Assess boundary firewalls for use of default credentials and settings(such as SNMP, Telnet, SSH).
▶ Monitor and visualise all traffic flow across the enterprise to provideassurance for firewall rule set.
▶ Alert (or block) traffic flows to and from the internet that violate
expected behaviour.

▶ Ensure all connected devices
have suitable host-based firewall
installed and functioning.
▶ Gain complete visibility into all
network traffic flows between
all connected devices; and thoseto the internet.

▶ Integrate with NGFW’s to allocate devices to specific firewall trustzones or rule sets.
▶ Assess all devices against a security baseline for their uniquedevice classification.
▶ Assess devices for known vulnerabilities, natively or through integration
with vulnerability assessment tools.

SecureConfiguration▶ Check and report on all running services and installed softwarefor desktop, laptop and servers.
▶ Assess IoT, IoMT, IT and cloud devices for use of default or out-of-thebox credentials.
▶ Assess network infrastructure for use of default credentials and settings(such as SNMP, Telnet, SSH).

Ensure all connected devices
are uniquely assessed for theirindividual security requirements
to remove any default or weak
configuration and remediate
misconfiguration and risk.

▶ Integrate with mobile device management (MDM) solutions to discoverand assess mobile phones and tablets.
▶ Check and report on users’ accounts in use on all desktop, laptopand servers.
▶ Leverage Activity Directory Group Membership to control accessto resources or align control policies.

User AccessControl▶ Integrate with privilege access management solutions to monitor
and control escalated access.
▶ Leverage user or device credentials to provide least privilege network
access control policies.
▶ Overlay username or group membership to Network Traffic Flow
Visualisation Matrix.
▶ Assess all devices to ensure a suitable anti-malware (AV/EDR/EPP)
solution is installed and functioning.
▶ Assess all devices to ensure the AV/EDR/EPP signatures are up to date.

MalwareProtection▶ If available ensure a suitable vulnerability assessment tool is installed
and has assess the device recently.
▶ Integrate with mobile device management solutions to discover andassess mobile phones and tablets.
▶ Quarantine or restrict high-risk or known compromised devices detectedby the AV/EDR/EPP/VA tools.
▶ Assess all devices to ensure they are running a suitable and supported
operating system.
▶ Check for critical patches and hotfixes to all operating systems

Security UpdateManagement▶ Assess all devices to ensure suitable security tools are installed
and patched correctly.
▶ Check and report on all running services and installed softwarefor desktop, laptop and servers.
▶ Assess software and services for vulnerabilities and patch as required.
▶ Integrate with patch management tools or initiate remediation throughcontrol policies.

Align user to device context togain a better understanding of
the devices on your network andthe users that are currently using
them. Use this combined context
to monitor traffic flows andcommunication patterns between
users, the device they use and theapplications, servers and services
they interact with.

▶ Ensure all connected devices
have suitable security tools
installed, functioning and up
to date to minimise the riskof infection from malware.
▶ Automate Incident response
to detected threats and prevent
lateral spread of infections.

Orchestrate 3rd-party patch
management tools and/orautomate patch management
and the deployment of suitablehotfixes, and/or agents to remove
vulnerabilities and minimiserisk posture.

1 https://www.ncsc.gov.uk/cyberessentials/overview
https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-IT-infrastructure-2-2.pdf

Forescout Technologies, Inc.

©2023 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,

Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Inc. is a Delaware corporation. A list of our trademarks and patents is available at
Other brands, products, or service names may be trademarks or service marks ofLearn more at Forescout.com

their respective owners. Version 01_01

www.forescout.com/company/legal/intellectual-property-patents-trademarks.

2