Cyber Essentials Readiness

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Cyber-Essentials-Readiness

The Cyber Essentials page shows how your Windows computers are doing against the five technical controls of the NCSC's Cyber Essentials scheme. It is a live picture drawn from the RSJ Agent on each machine, so it is there whenever someone asks "are we in good shape?"

Open it from the Cyber Essentials item in the sidebar, or at https://<server-address>:8443/ce. Admin, technician and SLT accounts can all see it. Only admins can download the PDF.

This is evidence, not certification #

Please read this part first.

Groundskeeper does not certify you for Cyber Essentials and cannot tell you that you will pass. The page and the PDF show what the agents have reported. They are information to help you prepare, and to show governors, insurers or an assessor what you are doing about it.

The Terms of Use (section 4.2) say the same about every indicator in the product: they are information, not a guarantee, certificate or assurance that your systems are secure or compliant. Groundskeeper can be wrong or miss a problem, and you remain responsible for your own systems. Certification comes from an assessment by a Cyber Essentials certification body.

Two more limits to keep in mind:

It covers Windows client devices that run the RSJ Agent, and nothing else. Servers are left out (they are assessed against a separate baseline), and so is any device without the agent.
It covers the technical controls only. The assessment also asks questions only a person can answer, such as what is in your scope.

What you see #

At the top is a banner with the overall result and a count of how many of the five controls are fully met. Below it are four tiles (enrolled clients, controls met, amber controls, red controls) and one card for each control.

Each card shows:

A coloured label for the control.
A bar and a line such as "18 of 20 devices meet this control", with how many devices are not reporting on that control.
A plain-English description of what is checked.
The names of the devices that need attention (the first eight, then "+N more").
A note where the coverage is only partial.

The page reads the latest agent check-ins when it opens. Reload it to refresh. If no devices have the agent yet, it says so and links to Agent Settings.

The five controls and what each is measured from #

Every control is measured from what the agent reports from each client machine. There are no connectors involved.

Control	What counts as meeting it
Firewalls	The Windows Firewall domain profile is on.
Secure Configuration	BitLocker reports the C: drive as protected. This is a stand-in for the control, not a full check (see below).
Access Control	BitLocker again, as a measure of protecting data at rest. Also a partial stand-in (see below).
Malware Protection	Microsoft Defender is on and its signatures are no more than three days old.
Patch Management	No restart is waiting, and the machine is not late with Windows updates (see below).

Patching and the 14-day rule #

Cyber Essentials asks for updates to be applied within 14 days of their release, not within 14 days of the last time a machine updated. Groundskeeper therefore works from Microsoft's monthly release day (Patch Tuesday). A machine is late only once 14 days have passed since the first Patch Tuesday it has missed. A machine on the newest update is current, however long ago that update came out. A machine with a restart pending is counted as not meeting it, because the update has not finished.

Secure Configuration and Access Control are partial #

These two controls need a human audit: default passwords changed, unneeded software and accounts removed, access rights reviewed. A tool cannot see that from a PC. Groundskeeper measures BitLocker for both, so a machine with BitLocker off appears under both cards, and a machine that passes tells you nothing about the rest of what those controls cover. Each card says "partial coverage" for this reason. Treat a green on these two as "encryption is in place", not "this control is met".

Other things worth knowing #

Firewall profiles: only the domain profile is checked. The private and public profiles, which a laptop uses away from school, are not.
Antivirus: the malware check reads Microsoft Defender only. It does not read other antivirus products.
Devices that have not reported: a machine that has sent nothing for a control is shown as not reporting. It is counted as neither meeting the control nor not, and left out of that control's percentage. So the percentage means "of the devices we have evidence for". Check the not-reporting number as well as the percentage.

Red, amber and green #

Each control is judged on the devices that have reported for it:

Colour	Screen says	Rule
Green	Meets	Every reporting device meets it.
Amber	Mostly meets	At least 90% meet it, but not all.
Red	Needs attention	Fewer than 90% meet it.
Grey	No data	No device has reported for this control yet.

The overall colour is that of the worst control, but it is never green while any control is grey: one control with no data makes the overall amber, and the banner says which control has no data yet. If every control is grey, the overall is grey. Look at the individual cards, not just the banner.

The PDF uses slightly different words for the same colours: Meets, Minor gaps, Needs attention and No data.

The PDF report #

Click CE readiness report (PDF) at the top right. The file is built on your own server and nothing is sent anywhere. It contains:

The school's name and the date it was made.
The overall result and the four headline counts.
Each control's result, how many devices meet it and how many are not reporting, the description, any partial-coverage note, and the names of the devices that need attention.
The coverage notes and a short methodology paragraph, which repeats the limits above: client devices with the agent only, not-reporting devices left out, and two controls only partly covered.

It shows exactly the same figures as the page, so the two cannot disagree. It is useful in front of governors, a cyber insurer or your certification body. It is not a certificate, and the PDF itself says it is not a safeguarding, filtering or Ofsted assessment. For filtering and monitoring, see DfE Filtering and Monitoring Readiness.

Getting more devices reporting #

Coverage grows as the agent reaches more machines. Deploy it from Agent Settings. If many devices show "not reporting", check they are switched on, domain-joined Windows clients, and that the agent is checking in. See Getting Started and Troubleshooting.

Groups of schools using Central Edition also get a cross-school Cyber Essentials view on the hub.