Cyber Essentials Plus Newcastle upon Tyne

Cyber Essentials Plus audits for Newcastle upon Tyne organisations, assessed and certified by an appointed Certification Body and run remotely as standard.

Cyber Essentials Plus is the same five controls as Cyber Essentials, independently audited rather than self-assessed. An assessor tests a sample of device types across your estate instead of taking your word for the answers, which is precisely why clients and insurers ask for it.

Why Newcastle organisations get asked for Plus

Rarely because somebody decided to be thorough. Almost always because a specific contract named it. The most common sources across the North East are health and public sector supply chains, larger corporate customers running supplier assurance programmes, and insurers at renewal.

If you have been asked, the useful first step is reading the exact clause. Contracts that say Cyber Essentials and contracts that say Cyber Essentials Plus are routinely conflated in the brief that reaches us, and the difference is substantial in both cost and timetable. It is worth ten minutes to establish which one you are actually facing.

How the audit runs when we are not in the building

Remotely, and this is not a compromise made for distance. Remote delivery is how the audit normally runs for clients a mile away.

In practice it means screen sharing with whoever administers your devices, a scan of your external footprint, an authenticated internal scan across a sample of user devices covering every device type in scope, and a set of tests run on those devices to confirm that the controls behave as claimed. Email and web filtering tests are included. The co-ordination required from you is modest: someone with administrative access available for the session, and the sampled devices switched on and reachable.

Because the audit samples a selection of device types under IASME’s rules rather than charging per device, the price is a fixed band by organisation size rather than something that climbs with your headcount.

What usually costs a pass

Three things, in roughly this order.

Unsupported software. An operating system, browser, plugin or application past its security update support, found on a machine during the scan. This is the single most common cause of a failed audit and it cannot be argued around.

Missing updates. The scheme requires high and critical severity patches to be applied within fourteen days. An estate that patches monthly will fail on something, and the gap is usually in the applications rather than the operating system.

Multi-factor authentication gaps on cloud services. Enabled for most accounts, missing on an administrative account, a shared mailbox or a legacy integration. The audit looks at every account in scope rather than the typical one.

Book an audit slot →

Sequencing, and the three month rule

Plus must follow a valid Cyber Essentials certificate, and the audit has to be completed within three months of that certificate being issued. Miss the window and the self-assessment has to be redone.

That single rule decides most Cyber Essentials Plus timetables. If a contract requires Plus, plan both stages together from the start rather than treating the self-assessment as a standalone piece of work that you will follow up when convenient. Where a date is already tight, we offer an urgent turnaround, and we would rather tell you early that a date is not achievable than take the booking and disappoint you.

Note also that the Cyber Essentials First Step Fund, which cuts the cost of a first Cyber Essentials certificate until March 2027, does not extend to Plus. The audit is a separate cost whatever funding covers the self-assessment.

A dry run, if you would rather not find out the hard way

Where an estate is complicated or a failure would be expensive, we will run the technical checks before the formal audit so that anything that would fail surfaces while there is still time to fix it. It costs more than going straight in, and for most organisations it is unnecessary. For an organisation with a contract riding on the result and a mixed estate, it is usually the cheaper path.

Cyber Essentials Plus for Newcastle organisations

Solusec is an appointed Certification Body and a Lead Cyber Essentials Plus Assessor signs off every audit we issue. There is no subcontracting of the assessment to a third party and no handoff between the people who prepare you and the people who audit you.

We hold Cyber Essentials Plus ourselves, which is a lower bar than it sounds but does mean the audit has been run on us as well as by us. Being based in Shropshire makes no difference to an audit delivered remotely, and no travel is charged because none is required.