Skip to main content
All CollectionsData Protection
Compliance with UK Cyber Essentials
Compliance with UK Cyber Essentials
Séamus Diamond avatar
Written by Séamus Diamond
Updated over a month ago

Ensuring Compliance with Cyber Essentials: Requirements for IT Infrastructure v3.1

The UK’s Cyber Essentials is a government-backed scheme designed to help organizations protect themselves against a range of the most common cyber attacks. The latest version, v3.1, outlines essential requirements for IT infrastructure to ensure robust cybersecurity practices. This article will guide you through how EvolutionX can be configured to comply with these standards, highlighting the shared responsibility model between EvolutionX and its store owners. For more detailed information, you can refer to the official Cyber Essentials: Requirements for IT Infrastructure v3.1 PDF.

Scope of Compliance

The scope of compliance for EvolutionX under the Cyber Essentials standard includes both the SaaS infrastructure provided by EvolutionX and the configurations managed by the store owner. EvolutionX is responsible for ensuring that the underlying infrastructure is secure and compliant with the standards, while store owners must configure and manage their store Admin settings and user settings to maintain compliance. This shared responsibility model ensures that both the platform and its usage adhere to best practices in cybersecurity.

Compliance Areas and Responsibilities

1. Firewalls

Responsibility: EvolutionX
Configuration:

  • EvolutionX is hosted in AWS data centers which are Cyber Essentials Plus Certified

  • EvolutionX ensures that all incoming and outgoing traffic is filtered through AWS firewalls such as EC2 Security Groups and Web Access Firewall (WAF). This includes setting up rules to block unauthorised access and allowing only necessary traffic.

2. Secure Configuration

Responsibility: Both EvolutionX and Store Owner
Configuration:

3. User Access Control

Responsibility: Both EvolutionX and Store Owner
Configuration:

4. Malware Protection

Responsibility: EvolutionX
Configuration: EvolutionX deploys anti-malware solutions to protect the SaaS infrastructure and staff devices from malicious software. This includes regular updates and scans to detect and remove malware.

5. Security Update Management

Responsibility: Both EvolutionX and Store Owner
Configuration:

  • EvolutionX: Regularly updates the SaaS platform with the latest security patches and updates.

  • Store Owner: Ensures that any third-party applications or plugins added by the Store Owner within the platform are also kept up to date with security patches.

6. Multi-Factor Authentication (MFA)

Responsibility: Both EvolutionX and Store Owner
Configuration:

7. Data Backup

Responsibility: EvolutionX
Configuration:

8. Asset Management

Responsibility: EvolutionX
Configuration: EvolutionX maintains an internal inventory of assets, including hardware and software, ensuring that all assets are accounted for and managed securely.

9. Incident Management

Responsibility: Both EvolutionX and Store Owner
Configuration:

By following these guidelines, EvolutionX and its Store Owners can ensure compliance with the UK’s Cyber Essentials standards, providing a secure and reliable ecommerce platform.

Did this answer your question?