On this page

Business Critical Data Protection Guide

1. Purpose of this Guide

This artefact proves that your organisation’s most valuable data — customer records, financial systems, intellectual property — is properly safeguarded. Cyber Essentials requires this because it’s not enough to know what critical data you have (that’s covered by your Inventory List); you must also show it’s protected by technical controls like encryption, access management, and secure backups.

2. What You Will Submit

You will need:

  • A screenshot showing protection measures applied to business-critical data.

  • Acceptable evidence sources include:

    • Encryption settings enabled (e.g. BitLocker, FileVault, AWS KMS).

    • Access controls (e.g. user permission matrix, restricted folders).

    • Backup protection (e.g. immutable backups, retention policies, MFA for restores).

  • The screenshot should show:

    • Service or system name.

    • Security control in action (enabled/active).

    • Timestamp or version (to prove recency).

3. How to Collect / Obtain / Generate This Evidence

Operating System Encryption:

  • Windows: Open Control Panel → BitLocker Drive Encryption → Screenshot showing BitLocker “On” for system drives.

  • macOS: Go to System Settings → Security & Privacy → FileVault → Screenshot showing FileVault “On.”

Cloud Storage (SharePoint / Google Drive):

  • SharePoint (Microsoft 365):

    1. Open the Microsoft 365 Security & Compliance Center.

    2. Go to Information Protection → Sensitivity Labels / Retention Policies.

    3. Screenshot showing that sensitive SharePoint sites are labelled as Confidential/Restricted and covered by retention/encryption policies.

    4. Alternatively, open a specific SharePoint site → Settings → Site Permissions and capture the restricted access list (only specific groups/users can access).

  • Google Drive (Google Workspace):

    1. Open the Google Admin Console.

    2. Navigate to Apps → Google Workspace → Drive and Docs → Sharing Settings.

    3. Screenshot showing restricted sharing settings (e.g. only internal users, restricted external sharing).

    4. For critical folders, open Google Drive → File/Folder → View details → Manage Access and screenshot the limited permissions (only authorised users, no public links).

Database Protection (e.g. MongoDB Atlas, AWS RDS):

  1. Open the database console.

  2. Navigate to Security → Encryption or Backups.

  3. Screenshot showing “Encryption at Rest” enabled and access restricted.

Backup Protection:

  • Microsoft 365: Open Compliance Center → Information Protection → Retention Policies → Screenshot showing critical data under retention lock.

  • Google Workspace: Use Vault (if licensed) → Screenshot showing retention rules applied to Drive content.

4. Evidence Format

  • Accepted file types: PNG, JPG, PDF.

  • Suggested naming format:
    YourCompanyName_DataProtection_YYYY-MM-DD.png
    Example: AcmeCorp_DataProtection_2025-07-01.png

5. What “Good” Looks Like

  • Control is enabled and visible (not just a greyed-out option).

  • Screenshot clearly shows encryption, access restriction, or backup immutability.

  • Includes timestamps, policy names, or system identifiers.

  • Demonstrates protection for critical, not just general, data.

Why it matters: auditors need to see more than a policy statement — they want real proof that security controls are switched on and active.

6. Tips

  • Redact sensitive names (e.g. database IDs, customer names) before uploading.

  • Pair multiple screenshots if needed (e.g. one showing encryption, one showing backup immutability).

  • Update your evidence at least annually — stale screenshots may be rejected.