XWiki for Cyber Essentials (UK)

Cyber Essentials: The UK's Baseline Security Certification

The Cyber Essentials scheme, backed by the UK National Cyber Security Centre, establishes five technical control themes that organizations must implement to defend against the most common cyber attacks. While the controls themselves are fundamentally technical, achieving and maintaining certification requires documentation that demonstrates each control is not merely deployed but actively managed, regularly reviewed, and consistently applied across the organization's IT estate. For organizations supplying to UK government contracts where Cyber Essentials certification is mandatory, or for businesses seeking to demonstrate baseline security maturity to customers and partners, the documentation challenge is often more daunting than the technical implementation. Firewall rules that exist only in router configurations, access control decisions remembered only by the IT administrator who made them, and patching schedules that live in someone's personal calendar do not constitute the documented evidence that certification requires.

XWiki, the open-source enterprise wiki platform with over twenty years of development and more than 800 teams relying on it globally, provides the structured documentation environment that transforms Cyber Essentials from a certification hurdle into an operational security framework. With over 900 extensions, support for more than 40 languages, and the flexibility that comes from its LGPL license, XWiki gives organizations a documentation platform they fully control. Deployed on MassiveGRID's managed hosting with data centers in London, Frankfurt, New York, and Singapore, the platform operates on infrastructure backed by ISO 9001 certified operations, GDPR-compliant data handling, a 100% uptime SLA, and 24/7 support.

Boundary Firewalls and Network Segmentation

The first control theme in Cyber Essentials addresses boundary firewalls and internet gateways, requiring organizations to ensure that every device connected to the internet is protected by a correctly configured firewall. For organizations with complex network architectures spanning multiple offices, cloud environments, and remote access solutions, documenting the boundary protection comprehensively enough for certification assessment is a significant undertaking. The documentation must demonstrate not just that firewalls exist but that their rule sets are justified, regularly reviewed, and changed only through controlled processes.

XWiki enables organizations to create a network security documentation space where firewall rule sets are documented with their business justifications, network architecture diagrams show all boundary points and security zones, and change logs record every modification to the firewall configuration. Each firewall rule page can capture the rule description, the source and destination addresses, the permitted services, the business justification for the rule, the date it was created, the person who authorized it, and the date it was last reviewed. This structured approach eliminates the common problem of firewall rule accumulation, where rules are added over years without documentation and no one can explain why they exist or whether they remain necessary.

Network architecture documentation maintained in XWiki includes diagrams showing all security zones, the boundaries between them, and the protection mechanisms at each boundary. These diagrams are versioned alongside the rest of the documentation, ensuring that the current architecture is always documented and that previous architectures remain accessible for comparison and audit trail purposes. When the organization adds a new office, deploys a new cloud service, or changes its network segmentation, the architecture documentation is updated through XWiki's normal editing process, with the version history capturing who made the change and when.

Regular review schedules for firewall rules and network architecture can be managed through XWiki's notification system, alerting the responsible network administrator when review periods are approaching. The review itself is documented as a version update or review confirmation entry, creating the evidence that the organization actively manages its boundary protection rather than deploying it once and assuming continued effectiveness. This regular review evidence is precisely what Cyber Essentials assessors look for when evaluating whether boundary firewall controls are maintained as ongoing operational practices.

Secure Configuration Management

The secure configuration theme requires organizations to ensure that computers and network devices are configured to reduce vulnerabilities and provide only the services required. This extends beyond the initial hardening of systems to encompass the ongoing management of configurations, the documentation of configuration baselines, and the controlled handling of deviations from those baselines. Organizations must demonstrate that default passwords have been changed, unnecessary services have been disabled, and only necessary software is installed and maintained.

Configuration baselines documented in XWiki define the standard secure configuration for each type of system in the organization's environment. A Windows workstation baseline page might specify the required operating system settings, the mandatory security software, the disabled services, the permitted applications, and the network configuration requirements. A server baseline page would cover a similar range of settings appropriate to the server's role. By maintaining these baselines as structured wiki pages, organizations create a reference standard against which actual system configurations can be compared and against which any deviations must be justified.

Hardening standards that implement the configuration baselines can be documented as procedural guides linked to the baseline pages. These guides provide step-by-step instructions for applying the baseline configuration to new systems, ensuring consistency regardless of which technician performs the build. XWiki's template system allows organizations to create hardening procedure templates that can be instantiated for specific system types, with the completed procedure pages serving as evidence that the hardening process was followed for each system deployment.

Deviation records are perhaps the most important component of secure configuration documentation because they capture the instances where a system cannot comply with the baseline and the compensating measures applied. A deviation record page in XWiki captures the system or systems affected, the baseline requirement that cannot be met, the business or technical reason for the deviation, the compensating controls applied to mitigate the risk, the approver who authorized the deviation, and the review date by which the deviation must be reassessed. Approval workflows ensure that deviations cannot be self-authorized by the technical staff requesting them, and the version history creates an immutable record of when deviations were approved and by whom.

Access Control Implementation

The access control theme requires organizations to ensure that only authorized users can access systems, and that each user has only the level of access required for their role. This encompasses user account management, authentication mechanisms, and the principle of least privilege. The documentation must demonstrate that user provisioning follows a controlled process, that access rights are appropriate to job functions, and that authentication mechanisms meet the scheme's requirements for password complexity and account lockout.

User provisioning documentation in XWiki captures the complete lifecycle of user access from initial request through approval, implementation, periodic review, and eventual deactivation. Each provisioning request exists as a structured page documenting the requested access, the business justification, the approving manager, and the implementation confirmation. This documented process ensures that access decisions are traceable to authorized individuals and that no access is granted without explicit approval.

Least privilege documentation requires organizations to map job roles to access requirements and demonstrate that each user's access aligns with their role. XWiki pages for role definitions can specify the systems each role requires access to, the level of access appropriate for the role, and any temporary elevated access procedures that apply when staff need to perform tasks outside their normal access scope. Access review pages document the periodic verification that user access remains aligned with role definitions, with review findings and corrective actions captured in the version history.

Authentication documentation covers the password policy, multi-factor authentication deployment, and account management procedures. Password policy pages in XWiki specify the minimum requirements for password length, complexity, and change frequency, while linked configuration evidence pages show that these requirements are technically enforced across systems. Account lockout policies and their implementation evidence demonstrate that brute-force authentication attacks are mitigated. Audit logs from authentication systems can be uploaded to XWiki pages as evidence that authentication controls are monitored and that failed authentication attempts are detected and investigated.

Malware and Patch Management

The final two control themes address malware protection and security update management, requiring organizations to deploy anti-malware software and to keep software current with security patches. These themes are operationally intensive because they require continuous activity rather than one-time configuration, and the documentation must demonstrate that both malware protection and patching operate as ongoing managed processes across the entire IT estate.

Anti-malware deployment documentation in XWiki captures the malware protection strategy, including the software deployed, the systems it protects, the update mechanism, the scanning schedule, and the response procedures for detected malware. Deployment coverage pages show which systems have anti-malware software installed and which are excluded, with justifications for any exclusions. Update status documentation demonstrates that signature databases are current and that the anti-malware software itself is updated to the latest version. When malware is detected, incident pages capture the detection details, the response actions taken, and any follow-up investigation or remediation required.

Patch management documentation is critical for Cyber Essentials because the scheme requires that high-risk and critical security patches be applied within fourteen days of release. XWiki enables organizations to document their patch management process comprehensively, from the vulnerability notification and assessment stage through testing, approval, deployment, and verification. Patch schedule pages can track each patch cycle, identifying the patches to be applied, the systems targeted, the testing performed, and the deployment dates. The version history timestamps these entries, providing the time-bound evidence that patches were applied within the required fourteen-day window.

Vulnerability remediation tracking links detected vulnerabilities to the patches or configuration changes that address them, creating a closed-loop system where every identified vulnerability can be traced to its resolution. XWiki pages for vulnerability tracking capture the vulnerability identifier, the affected systems, the severity assessment, the remediation action planned, and the completion evidence. When vulnerabilities cannot be remediated through patching alone, compensating control documentation captures the alternative measures applied and the justification for their adequacy.

MassiveGRID's London data center provides UK-based hosting for organizations that prefer to keep their security documentation within UK jurisdiction, while the Frankfurt, New York, and Singapore locations serve organizations with international operations. The ISO 9001 certified operations and 100% uptime SLA ensure that security documentation is reliably available, and the 24/7 support team provides assistance with infrastructure management. Organizations comparing documentation platforms can review the XWiki vs. Confluence enterprise comparison for analysis of how open-source and proprietary platforms compare for security compliance documentation needs.

How long does it take to achieve Cyber Essentials certification using XWiki for documentation?

The certification timeline depends primarily on the organization's existing security posture and the gap between current practices and Cyber Essentials requirements. Organizations that already implement the five control themes but lack documentation can use XWiki to create the necessary evidence base within four to eight weeks, leveraging templates and structured page hierarchies to document existing controls systematically. Organizations that need to implement controls alongside documentation should plan for eight to sixteen weeks, allowing time for technical implementation, documentation creation, and internal review before submitting the self-assessment questionnaire. XWiki accelerates the documentation phase specifically because its template system ensures consistency, its structured data capabilities support the detailed evidence that assessors evaluate, and its version history immediately begins building the ongoing maintenance evidence that demonstrates sustainable compliance rather than point-in-time certification.

Should organizations pursue Cyber Essentials self-assessment or use an external assessor, and how does documentation differ?

Cyber Essentials basic certification uses a self-assessment questionnaire verified by an accredited certification body, while Cyber Essentials Plus adds a hands-on technical verification performed by an external assessor who tests the controls directly. The documentation requirements for both levels are fundamentally the same, as both require the organization to demonstrate that all five control themes are implemented and maintained. However, Cyber Essentials Plus assessors will reference the documentation during their technical testing, using it to understand the organization's environment and validate that the tested controls match the documented architecture and procedures. XWiki documentation prepared for Cyber Essentials basic certification serves equally well for Plus assessment, with the additional benefit that the version history demonstrates documentation maturity and active management. Organizations pursuing Plus certification benefit from XWiki's ability to present a coherent, navigable documentation set to assessors, reducing assessment time and demonstrating the kind of organized security management that builds assessor confidence.

How frequently must Cyber Essentials certification be renewed, and how does XWiki support ongoing compliance?

Cyber Essentials certification is valid for twelve months and must be renewed annually through a fresh self-assessment or Plus assessment. This annual renewal cycle means that documentation must remain current throughout the year rather than being created once for initial certification and then neglected. XWiki supports this ongoing compliance requirement through notification reminders that alert control owners when documentation reviews are due, version history that demonstrates continuous maintenance between certification cycles, and the collaborative editing capabilities that allow multiple team members to keep their areas of documentation current without bottlenecking through a single compliance administrator. When the annual renewal assessment approaches, the organization's documentation is already current because it has been maintained as an operational tool throughout the year. The assessor can review the version history to confirm that documentation has been actively maintained, providing evidence of sustained compliance rather than annual certification preparation, which increasingly distinguishes organizations that genuinely manage their cyber security from those that treat certification as a periodic administrative exercise.