MCSS: Decrypting Minimum Cyber Security Standards Best Practices and Guidelines

3. Detect

Detection ensures that risks are identified before damage is done or a breach occurs. According to MCSS, detection revolves around one primary standard, which is:

• Departments shall take steps to detect common cyber-attacks: Departments must define what needs protecting and why, and should capture events that can be combined with common threat intelligence sources to detect known threats. Attackers attempting to use common cyber-attacks should be unable to gain access to technology services without detection, and digital services that are attractive to cyber criminals should implement transactional monitoring techniques at all times. 

4. Respond

Adequate and immediate responses should then be implemented, predominantly through one MCSS stipulation:

• Departments shall have a defined, planned and tested response to cyber security incidents that impact sensitive information or key operational services: Incident response and management plans should be implemented with clearly defined actions, roles, and responsibilities, including communication protocols in the event of a breach. Plans should also comply with the legal obligation to report all breaches involving personal data to the Information Commissioner’s Office, and should be tested regularly to ensure efficiency.⁴ 

5. Recover

Fast and efficient recovery from breaches is fundamental to ongoing protection and, according to MCSS, should involve one primary focus: 

• Departments shall have well defined and tested processes to ensure the continuity of key operational services in the event of failure or compromise: Contingency mechanisms should be identified and tested to ensure the continuation of key operational services in the event of compromised systems. Business continuity plans should be well-practised, inform the immediate future technical protection of the system or service in question, and ensure that systematic vulnerabilities are identified and remediated.

Where should you go above and beyond?

MCSS provides an undeniably crucial baseline for public sector cyber security. However, as threats evolve, organisations need to consider ways to provide security best practices that offer more than these minimum requirements. A robust security strategy that’s even harder for cyber criminals to overcome should look to:

• Protecting sensitive information: Work from home arrangements that weren’t particularly relevant during MCSS implementations are now raising security questions for as many as 86% of business executives.⁵ This has highlighted the need for specified work from home security policies and VPN protections that drastically increase protection. 

• Guarding against all types of cyber-attacks: MCSS stipulates the need to protect against common risks, but cyber crime increases of 31% across the pandemic alone have revolved mainly around new and evolving threats.⁶ This includes increasingly difficult to manage ransomware (as seen in the NHS WannaCry attack), and intelligent, socially engineered phishing scams.⁷ A heightened focus on training and responsive security plans should meet these risks head-on, as well as keeping existing MCSS policies ticking over to avoid long-standing risks.

• Penetration testing: Penetration testing outside of compliance expectations enables organisations to identify levels of technical risk that aren’t necessarily considered within MCSS. This makes it possible to account for arising threats during the configuration of security goals, creating a protective barrier with the potential to provide far more comprehensive security resistance.
• Understanding risk appetites (and tolerance): To meet their objectives, many public sector organisations will need to accept some level of risk that isn’t considered in MCSS. By taking the time to understand risk appetites and tolerance through comprehensive risk assessments, it’s far easier to align risk with strategic objectives and determine when action should be taken. 

Further reading: For more on cyber security best practices, take a look at our blog — Cyber Security Best Practices in 2021: How to Do More With Less

Establish partnerships for the best outcomes

While MCSS guidelines raise the bar in terms of minimum security requirements, in the context of an evolving risk landscape, extensive security processes are essential for public sector organisations in order to avoid the damage that breaches can bring. Achieving this in-house is not only time consuming and costly, but also means the risk of falling behind compliance standards is very real. 

Ongoing security protections that adhere to and enhance MCSS rely on adaptable and expansive solutions. Security partnerships like those offered by our team here at Six Degrees are here to make this a reality. 

Using our understanding of the threats facing public sector organisations, we’ve developed affordable, easy-to-implement managed security solutions that understand the importance of cyber security as a journey, rather than a destination.

By working with you at every stage, we’ll help enforce policies that not only work alongside MCSS, but also account for new threats outside the scope of these minimum requirements, even in a risk landscape that’s evolving at every turn. 

Contact us today and see how Six Degrees can help your organisation develop a robust cyber security posture.