  Cyber Essentials (CE) comprise a set of controls designed to protect
organisations, irrespective of their size, against cyber attacks. The controls
are firewalls, secure configuration, user access control, malware protection &
security update management. In this work, we explore the extent to which CE
remains robust against an ever-evolving threat landscape. To that end, we
reconstruct 45 breaches mapped to MiTRE ATT&CK using an Incident Fault Tree (
IFT ) approach. Our method reveals the intersections where the placement of
controls could have protected organisations. Then we identify appropriate Cyber
Essential controls and/or Additional Controls for these vulnerable
intersections. Our results show that CE controls can effectively protect
against most attacks during the initial attack phase. However, they may need to
be complemented with additional Controls if the attack proceeds further into
organisational systems & networks. The Additional Controls (AC) we identify
include back-ups, security awareness, logging and monitoring. Our analysis
brings to the fore a foundational issue as to whether controls should exclude
recovery and focus only on pre-emption. The latter makes the strong assumption
that a prior identification of all controls in a dynamic threat landscape is
indeed possible. Furthermore, any potential broadening of technical controls
entails re-scoping the skills that are required for a Cyber Essentials (CE)
assessor. To that end, we suggest human factors and security operations and
incident management as two potential knowledge areas from Cyber Security Body
of Knowledge (CyBOK) if there is any broadening of CE based on these findings.
