Just Gilbey Achieves ISO 27001 and Cyber Essentials Plus

In March 2024, Just Gilbey IT Solutions achieved ISO 27001 certification and Cyber Essentials Plus, alongside ISO 9001. We’d always worked to high security standards; this was about proving it, with outside assessors checking our policies and testing our systems rather than taking our word for it.

Why an IT provider should be certified

An IT provider has privileged access to its clients’ systems: email, files, client records, sometimes banking. If the provider is careless, every client is exposed. Being small doesn’t make anyone safe either; small businesses are attacked too, they just rarely make the news.

In regulated industries and on government contracts, it’s common to expect not only the business but its whole supply chain to hold recognised certifications. If your insurer, clients or regulator ask how you manage your suppliers, a certified IT provider gives you a straightforward answer.

What each certification means

ISO 27001: information security management

ISO/IEC 27001 is the international standard for information security management systems. It requires a company to identify its information security risks, put controls in place to manage them, and keep reviewing and improving how it does so. Certification means an independent auditor has checked that system and that it’s being followed.

For clients, the practical point is this: when something does go wrong, there are written, tested policies and procedures for responding to it quickly and properly, and information that passes through our hands is handled to a certified standard.

Cyber Essentials Plus: tested security controls

Cyber Essentials is the UK government-backed scheme, overseen by the NCSC, that covers five technical controls: firewalls, secure configuration, security updates, user access control and malware protection. Together they protect against the most common attacks, such as phishing and exploiting unpatched software.

Standard Cyber Essentials combines a self-assessment with an independent review. Cyber Essentials Plus goes further: an assessor carries out hands-on technical testing to verify the controls actually work. Certificates last 12 months, so it has to be renewed every year.

ISO 9001: quality management

ISO 9001 is the international standard for quality management. For us it means documented, repeatable ways of working, checked by an outside auditor.

The problems these controls address

The threats most small businesses face haven’t changed much:

• Phishing and email compromise: staff tricked into handing over passwords or approving fake payments.
• Ransomware: systems locked and data stolen, with a demand for payment.
• Data breaches: unauthorised access to client or staff information, with the reporting duties and damage to trust that follow.

Cyber Essentials Plus controls reduce the chance of these happening. ISO 27001 makes sure that, if one does, the business responds in a planned way.

What you can do now

• Turn on multi-factor authentication for email and every cloud service.
• Keep software updated. Cyber Essentials requires critical and high-risk updates within 14 days.
• Train your team to spot phishing and to check any change to bank details by phone.
• Check your suppliers’ certifications, starting with your IT provider. Don’t just look at a logo on a website: look the certificate up on the IASME certificate search or UKAS CertCheck.

You can check ours the same way. We hold Cyber Essentials Plus, ISO 27001 and ISO 9001, and our About page links to each certification body’s register.

If you’d like your own business to meet the same standards, our cyber security service is built around these controls, and we can help you get Cyber Essentials or Cyber Essentials Plus yourself.