Question 1

How is cyber security used?

Accepted Answer

Cyber security is used to prevent hackers and scammers from infiltrating the computers and personal files of victims. It can take the form of various preventative measures, including anti-virus software and user care.

Question 2

What are security policy requirements?

Accepted Answer

Every security policy is different depending on the nature of the business. Some common requirements include [policy ](/resources/what-to-include-in-an-it-policy)for:

Password use
Email use
Social media and internet use
Control of customer data
Classification of data
Handling of security breaches
Computer security and encryption

Question 3

What are the benefits of cyber security?

Accepted Answer

There are a variety of[ benefits to good cyber security](/resources/why-is-cyber-security-important). They include:

Protection for your business activities
Higher customer confidence
Fewer web outages which could damage your business
Better productivity on virus-free computers
Secure customer and client data

Question 4

What are the benefits of having a strong information security policy?

Accepted Answer

The fundamental advantage to having a strong information security policy is that it protects information integral to your business and your clients. Additional benefits include more protection in the face of cyber attacks, higher understanding of security threats, and added trust for the client.

Cyber security is good for business, find out more with our [guide](/resources/cyber-security-in-the-workplace).

Question 5

What are the benefits of ISO 27001?

Accepted Answer

The benefits of [**ISO 27001**](/resources/iso-27001-and-the-cyber-essentials-scheme) are varied and numerous, but the main one surrounds customer and client trust. An ISO 27001 certificate indicates to prospective clients that the holding business is trustworthy and that its storage of customer data is secure. It also shows that the business has swift and robust countermeasures to potential data breaches.

Question 6

What are the three types of security?

Accepted Answer

Security controls are separated into three different categories – these categories are **preventative**, **detective** and **responsive**.

Question 7

What are the types of cyber security threats?

Accepted Answer

There are a number of different cyber security threats, each with their own preventative methods. These include phishing attacks, ransomware, DDoS attacks and computer viruses.

Question 8

What certifications are needed for cyber security?

Accepted Answer

There are various certifications which can be used for cyber security. For individuals, each certificate demonstrates an intimate knowledge of various important aspects in the field such as ethical hacking and security managing. For businesses, the ISO 27001 is the standard specification which demonstrates a company’s dedication to tried and tested cyber security.

Question 9

What counts as a data breach?

Accepted Answer

A data breach is an incident when confidential and protected data has been accessed or stole by unauthorized figures. The information can be of any kind including financial, personal or for business purposes.

Question 10

What does cyber crime mean?

Accepted Answer

[Cyber crime](/resources/what-are-cyber-security-incidents) is the term used to describe use of illegal methods to carry out criminal activities online on the internet.

Question 11

Can I sue for a data protection breach?

Accepted Answer

In the event of a data protection breach, you can pursue legal action against the company that held your data. Contact a legal professional for more information.

Question 12

How can I learn cyber security for free?

Accepted Answer

There is a selection of free cyber security courses available online, but levels in the quality and validity of the information on these free courses can vary.

Question 13

Is network security the same as cyber security?

Accepted Answer

Network security and cyber security are different aspects of digital security. Cyber security normally refers to protective measures around devices connected to the internet. Network security refers to the act of protecting files and folders in devices which make up part of a local network.

Question 14

What are the 3 domains of information security?

Accepted Answer

The three domains of information security are as follows: 1) Confidentiality – how private and secret the information is. 2) Integrity – how accurate and error-free the information is. 3) Availability – how available and disruption-free the information is.

Question 15

What are the elements of cyber security?

Accepted Answer

The elements of cyber security can be split into various sections: Application security, Information security, Network security, Disaster planning, Operational security and End-user education.

Question 16

What are the three types of countermeasures?

Accepted Answer

The three types of countermeasures are, 1) Hi-Tech – technological and electronic countermeasures such as alarm systems, 2) Lo-Tech – Physical and analogue countermeasures such as padlocks and 3) No-Tech – Human responses such as risk assessments.

Question 17

What are the three types of security policies?

Accepted Answer

Three types of security policy are in place to ensure computer safety in working environments - they are the following: **Organisational security policy**, **System-specific policy** and **Issue-specific policy**.

Question 18

What are the types of security breaches?

Accepted Answer

There are a series of security breaches which can be created by hackers, they can be categorised as: virus/malware, phishing and DDoS attacks.

Question 19

Who discovered number theory?

Accepted Answer

Number theory was discovered by French mathematician Pierre de Fermat.

Question 20

Who invented VPN?

Accepted Answer

It is generally agreed that the framework that led to the invention OF VPN was first designed by Microsoft employee Gurdeep Singh Pall in 1996.

Question 21

How do I report cyber crime?

Accepted Answer

In cases of suspected cyber-crime, you can report the incident or incidents to ActionFraud, the UK government’s cyber-crime reporting unit. To do so, visit their website at [actionfraud.police.uk.](www.actionfraud.police.uk.)

Question 22

What are ISO 27001 requirements?

Accepted Answer

There are a range of ISO 27001 requirements – the two most important involved conducting a risk assessment and scoping the ISMS. You can find more information [here](/resources/iso-27001-and-the-cyber-essentials-scheme).

Question 23

What are the 4 types of cyber attacks?

Accepted Answer

There are a number of ways a cyber criminal can attack your devices and your files – some of these are as follows:

[Phishing attacks ](/resources/how-to-identify-email-phishing-scams)– hackers attempt to trick a victim into following a link or downloading an infected file.
Ransomware – a malicious kind of software which denies access to files until a ransom is paid to the hacker.
DDoS attacks – a DDoS attack overwhelms a site with access requests, shutting the site down for a significant amount of time.
[Computer viruses](/resources/malware-hacker-and-virus-prevention-guide) – a program or piece of code that changes the operating processes of a computer.

Question 24

What are the 5 internal controls?

Accepted Answer

The five internal controls in the COSO framework are:

Control Environment
Risk Assessment
Control Activities
Information and communication
Monitoring
Learn more [here](/resources/cyber-security-risk-assessment).

Question 25

What are the components of cyber law?

Accepted Answer

With cyber law being something of a young side of international law, there are many components to the field. Many of these are detailed by the individual nations in which the cyber crime is committed.

Question 26

What are the disadvantages of cyber crime?

Accepted Answer

Cyber crime can cause all manner of [problems ](/resources/what-are-cyber-security-incidents)for most companies. Cyber criminals, having infiltrated a business’ infrastructure, can gain access to company data, client information and financial details.

Cyber crime can also shut down a website, leading to periods of inactivity which can reduce incoming business.

Question 27

What are the NIS Regulations 2018?

Accepted Answer

The Network and Information Systems Regulations (NIS Regulations) provide legal measures aimed at boosting the level of security of network and information systems for the provision of essential services and digital services.

Question 28

What is a cyber security attack?

Accepted Answer

A cyber security attack is an attempt by a hacker to steal valuable and sensitive information, disrupt the operations of a website or illegally infiltrate a device which is connected to the internet.

Question 29

Why is ISO 27001 important?

Accepted Answer

The [ISO 27001 ](/resources/iso-27001-and-the-cyber-essentials-scheme)certificate is important for businesses because it demonstrates that the holder has taken the necessary steps to minimise exposure to cybercrime and to limit any potential damage. It also indicates to clients that the business’ data is contained on secure ICT systems.

Question 30

How can I protect my online privacy?

Accepted Answer

Online privacy is vital for safely browsing the internet. Here are some ways you can protect yourself and your privacy online:

- Regularly update your passwords, using a combination of letters, numbers and special characters
- Install anti-virus software with browser protection
- Use different passwords for different accounts
- On entering personal information, be sure to check the website uses HTTPS encryption. This is indicated by HTTPS appearing at the start of your URL

Question 31

How can you protect yourself from online threats?

Accepted Answer

There are numerous ways to protect yourself from online threats. Here are just a few:

- Set different and difficult to guess passwords for every account, ideally using a mixture of numbers, special characters and upper and lower case letters
- Install anti-virus software on all of your hardware and equipment
- Regularly review the privacy settings on your social media accounts
- Stay updated on scams and security breaches in technology
- Keep backups of your important documents and personal files

Question 32

How do I practice safe browsing?

Accepted Answer

To practice safe browsing, the following rules should be observed:

Pick hard to guess passwords and regularly update them
Install anti-virus software with browser protection
When entering personal information, ensure that the website uses HTTPS. You can find out if HTTPS is being used if there is a padlock icon in the browser URL
Don’t use the same password for multiple accounts
Try not to use public or free-to-use WIFI networks

Question 33

What are some safe browsing techniques?

Accepted Answer

Safe browsing is one of the most important aspects of [cyber security](/resources/cyber-security-in-the-workplace). The following techniques are key factors in safe browsing:

- Set up a firewall
- Install antivirus software
- Update passwords regularly, using a combination of letters, special characters and numbers
- Be careful when following links in emails
- Don’t use the same passwords for multiple accounts

Question 34

What are the 3 principles of information security?

Accepted Answer

Information security’s three guiding principles take the following form:
- Confidentiality – how private and secret the information is
- Integrity – how accurate and error-free the information is
- Availability – how available and disruption-free the information is

Question 35

What is a cyber security breach?

Accepted Answer

A [cyber security breach ](/resources/what-are-cyber-security-incidents)is an incident where sensitive or protected data is viewed, transmitted or stolen by a party who is unauthorised.

Question 36

What is a cyber security course?

Accepted Answer

A cyber security course teaches its learners the important factors that make up the fields of cyber security and data protection. It includes topics on data breaches, cyber attacks and cyber crime in general.

Question 37

What is the difference between information security and cyber security?

Accepted Answer

While information security and cyber security regularly cross paths, they are in fact different entities. Information security deals with the protection of sensitive, private and confidential information from data breaches of any type. Cyber security by contrast, secures ICT systems from exterior attacks.

Question 38

What is the main purpose of cyber security?

Accepted Answer

Cyber security’s role is to protect the integrity of computing systems which make up a business’ IT network. It prevents unauthorised access to data and sensitive information.

Question 39

Is an email address personal data under GDPR?

Accepted Answer

An email address is an identifier that could be used to identify somebody so it counts as personal data under GDPR.

Question 40

What are the 7 principles of GDPR?

Accepted Answer

The [7 principles of GDPR ](/resources/gdpr-key-principles)are lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

Question 41

What are the GDPR changes?

Accepted Answer

There are many changes that have come in as part of [GDPR](/resources/general-data-protection-regulations-checklist), but amongst the key aspects include new penalties of up to 4% of annual turnover (or €20m if that is greater); an increased focus on consent; expanded rights of access for individuals and the right to be forgotten.

Question 42

What countries are subject to GDPR?

Accepted Answer

The UK and all countries within the EU are subject to GDPR, but it also affects any business that holds personal information about people who live in the EU and the UK.

Question 43

What is considered PII under GDPR?

Accepted Answer

Personally Identifiable Information under GDPR means any information that could be used to identify a person when contained within data, so could include: names; email addresses; online identifiers, etc.

Question 44

Do I need to comply with GDPR?

Accepted Answer

Any business that holds personal data about a resident of the European Union needs to comply with GDPR, whether the processing of that data takes place in the EU or not. Any business that offers free or paid goods or services to EU residents needs to comply.

Question 45

How do I know if I am GDPR compliant?

Accepted Answer

The best way to check that you are GDPR compliant is to complete a Data Protection Impact Assessment from the ICO and, if needed, contact ICO for more information and advice afterwards.

Make sure you have read our [GDPR legislation with our guide](/resources/how-to-prove-you-have-met-the-gdpr-legislation).

Question 46

What is the main aim of the GDPR?

Accepted Answer

The main purpose of GDPR is to standardise and update the data protection laws across the European Union, which were previously dated and inconsistent.

Discover more about [GDPR's key principles with our guide](/resources/gdpr-key-principles).

Question 47

What is the maximum fine for not complying with the GDPR?

Accepted Answer

The maximum fine for a data breach under GDPR is 4% of annual turnover or €20m if that is a greater amount.

Question 48

Do I need to register with ICO under GDPR?

Accepted Answer

Data controllers (businesses that determine the purpose for which personal data is processed) need to register with ICO and pay a data protection fee, unless they are exempt (which applies to members of the House of Lords, elected representatives and prospective representatives).

Question 49

Does GDPR cover the deceased?

Accepted Answer

No, information about somebody who is deceased is not covered by GDPR because it is not classed as personal data.

Question 50

How long should personal data kept under GDPR?

Accepted Answer

There are no specific limitations for how long data should be kept under GDPR, but the guidance is that it should be kept no longer than is necessary.

Question 51

Does GDPR replace DPA?

Accepted Answer

GDPR didn’t replace the Data Protection Act, which was renewed in 2018 and covers areas not already covered by GDPR, including national security and immigration matters.

Question 52

What is GDPR ICO?

Accepted Answer

ICO is the Information Commissioner’s Office, an independent authority that upholds information rights to protect data privacy for individuals. GDPR is the General Data Protection Regulation, written under EU law to standardise data protection and privacy.

Question 53

What is meant by the right to be forgotten under the GDPR?

Accepted Answer

Also known as the right for erasure, it is the right under GDPR for an individual to request that a company deletes all personal information a company has about them.

Question 54

Is GDPR retroactive?

Accepted Answer

In theory, it isn’t, but best practice according to the ICO would be to have re-confirmed all consents for holding personal data that were gained before GDPR.

Question 55

What does GDPR compliance mean?

Accepted Answer

GDPR compliance means managing your usage of personal data in accordance with the regulations contained within [GDPR](/resources/gdpr-key-principles).

Question 56

What is a GDPR compliance checklist?

Accepted Answer

The ICO has created GDPR compliance checklists to help companies ascertain themselves whether they are compliant with GDPR.
Learn more about the regulations with our [GDPR checklist](/resources/general-data-protection-regulations-checklist).

Question 57

What is the GDPR 2018?

Accepted Answer

The General Data Protection Regulation 2018 is the EU regulation introduced in 2018 to cover data protection and privacy for all of the countries and individuals within the European Union and the UK.

Question 58

Are all rights under GDPR absolute rights?

Accepted Answer

Some of the rights under GDPR are absolute, like the right to stop a company’s data being used for direct marketing, but others, like the right to be forgotten, are not absolute and only apply in certain circumstances.

We take a look at what your rights are under GDPR in this [guide](/resources/gdpr-what-are-my-rights).

Question 59

Can I ask for my data to be deleted under GDPR?

Accepted Answer

Although it is not an absolute right and only applies in certain circumstances, individuals can make a request to have their personal data erased under GDPR and businesses need to respond to you within a month.

We take a look at what your rights are under GDPR in this [guide](/resources/gdpr-what-are-my-rights).

Question 60

Is a name personal data GDPR?

Accepted Answer

Any information that can distinguish someone from other people is an identifier and therefore a name is certainly personal data.

Question 61

What is PII under GDPR?

Accepted Answer

PII stands for Personally Identifiable Information and includes names, email addresses and any other kind of information a company might hold about you that could be used to identify you.

Learn more about PII with our [blog article.](/resources/5-things-to-consider-for-gdpr)

Question 62

Who is responsible for GDPR compliance?

Accepted Answer

Within companies, the responsibility for GDPR compliance lies with anyone whose role involves the use of personal data, all the way up to the highest level. A [Data Protection Officer](/resources/does-your-business-need-a-data-protection-officer) must be appointed under GDPR.

Question 63

Is an email address personal data under GDPR?

Accepted Answer

An email address is an identifier that could be used to identify somebody so it counts as personal data under GDPR.

Question 64

Are all rights under GDPR absolute rights?

Accepted Answer

Some of the rights under GDPR are absolute, like the right to stop a company’s data being used for direct marketing, but others, like the right to be forgotten, are not absolute and only apply in certain circumstances.

We take a look at what your rights are under GDPR in this [guide](/resources/gdpr-what-are-my-rights).

Business Compliance FAQs

Cyber Security

Cyber Security at Work

How is cyber security used?

What are security policy requirements?

What are the benefits of cyber security?

What are the benefits of having a strong information security policy?

What are the benefits of ISO 27001?

What are the three types of security?

What are the types of cyber security threats?

What certifications are needed for cyber security?

What counts as a data breach?

What does cyber crime mean?

General Cyber Security

Can I sue for a data protection breach?

How can I learn cyber security for free?

Is network security the same as cyber security?

What are the 3 domains of information security?

What are the elements of cyber security?

What are the three types of countermeasures?

What are the three types of security policies?

What are the types of security breaches?

Who discovered number theory?

Who invented VPN?

Cyber Security Legislation

How do I report cyber crime?

What are ISO 27001 requirements?

What are the 4 types of cyber attacks?

What are the 5 internal controls?

What are the components of cyber law?

What are the disadvantages of cyber crime?

What are the NIS Regulations 2018?

What is a cyber security attack?

Why is ISO 27001 important?

Cyber Security Practices

How can I protect my online privacy?

How can you protect yourself from online threats?

How do I practice safe browsing?

What are some safe browsing techniques?

What are the 3 principles of information security?

What is a cyber security breach?

What is a cyber security course?

What is the difference between information security and cyber security?

What is the main purpose of cyber security?

GDPR

GDPR Definitions

Is an email address personal data under GDPR?

What are the 7 principles of GDPR?

What are the GDPR changes?

What countries are subject to GDPR?

What is considered PII under GDPR?

GDPR in the Workplace

Do I need to comply with GDPR?

How do I know if I am GDPR compliant?

What is the main aim of the GDPR?

What is the maximum fine for not complying with the GDPR?

Do I need to register with ICO under GDPR?

GDPR Legislation

Does GDPR cover the deceased?

How long should personal data kept under GDPR?

Does GDPR replace DPA?

What is GDPR ICO?

What is meant by the right to be forgotten under the GDPR?

General GDPR

Is GDPR retroactive?

What does GDPR compliance mean?

What is a GDPR compliance checklist?

What is the GDPR 2018?

Personal GDPR

Are all rights under GDPR absolute rights?

Can I ask for my data to be deleted under GDPR?

Is a name personal data GDPR?

What is PII under GDPR?

Who is responsible for GDPR compliance?

Is an email address personal data under GDPR?

Technical GDPR

Are all rights under GDPR absolute rights?

Does GDPR apply to private individuals?

What data/information is protected by GDPR?

What qualifies as personal data under GDPR?