Measuring cyber essentials security policies

The design and maintenance of high-level security policies is an important starting point governing the implementation of security controls for a business. The choice of which security controls to implement is inherently a cost-benefit analysis that could greatly benefit from repeatable and adjustable quantitative methods, but defining a security policy is based on informal domain knowledge. In this paper we focus on security policies aimed to achieve a Cyber Essentials certification, a government backed scheme in the UK. We present a simple and transparent measure for such security policies, assigning them a numerical score to estimate their benefits for a particular network, allowing to compare them and to make them subject of a quantitative cost-benefit analysis. The score for policies is based on the CVSS scores for vulnerabilities, estimating how would a policy affect CVSS scores.