The controls we run inside our own business, mapped to NIST CSF 2.0 and CIS Controls v8.1, self-assessed and openly labelled as such.
At Alpha IT Solutions, security is built into how we operate, not bolted on for clients. We run our own business against the international best practices defined by the NIST Cybersecurity Framework 2.0 and the CIS Controls, and we work to the same standards we implement for the businesses we look after.
The five Cyber Essentials controls are covered by the safeguards below. We have not yet sat the external assessment. When we do, it will appear in our credentials with a link to the certificate.
Published by the US National Institute of Standards and Technology in February 2024. Version 2.0 organises security into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in this version to put accountability first. It is free to download and designed to be self-applied by organisations of any size.
Eighteen prioritised controls from the Center for Internet Security, broken into 153 individual safeguards. These are grouped by Implementation Group, and we work to IG1: the foundational 56 safeguards that CIS describes as essential cyber hygiene, and the right baseline for a business of our size.
Who is accountable, and against what.
You cannot protect what you have not counted.
The controls that stop the common attacks.
Noticing before the client does.
What happens in the first hour.
Backups you have actually restored from.
This is a self-assessment. We have worked through the controls and published what we run. No external assessor has audited it.
That distinction matters, so we are stating it rather than burying it. There is a meaningful difference between a company that has implemented a framework and a company that has been independently certified against a scheme. On this page we are the former.
Where we do hold something externally verified, it is listed on our credentials, each one linking to the public register it came from. Cyber Essentials is not on that list yet. It is externally assessed by a certification body appointed by IASME, it is the natural next step for us, and we would rather you heard that from us than noticed the gap.
If a provider ever tells you they are “NIST certified”, ask who certified them. There is no such certification.
Case study
Everything above is what we say we do. This is what it looked like when we turned the same check on ourselves, with the numbers we actually measured.
We ran our audit tool against one of our own production servers from outside the network, and it found a door on the latch: the server would take a password instead of demanding a key, and it would let the administrator account log straight in. Both were build defaults. Nobody had looked.
The part worth repeating is what nearly went wrong. We changed the setting, the configuration test passed, and password logins were still enabled, because a second file written when the server was built was quietly overriding the one we had edited. The only way to catch that is to ask the running service what it actually decided instead of trusting the file in front of you.
No client data, and no addresses published: an IP address can be personal data under UK GDPR.
Rather than repeat it here, the full write-up sits on our case studies page, with the numbers, the three checks we ran to confirm the fix, and a second audit that found four more ordinary problems.
Or the long article on remote access security for small businesses →
Clients and serious prospects are welcome to walk through what we run and how it is configured. Ask, and we will show you.