Cyber Essentials Plus Staffordshire

Book your Cyber Essentials Plus audit in Staffordshire

Tell us about your estate and we will confirm a date and a fixed price. You need a Cyber Essentials certificate less than three months old to certify to Plus, and we issue those too. The audit is hands on: external and internal scans, every internet gateway, and a sample of around ten per cent of user devices checked for patching inside fourteen days, malware protection, enforced MFA and user access. Anything it finds, you get 30 days to fix and be retested. No travel charge in Staffordshire.

Why Staffordshire organisations get asked for Plus

Staffordshire makes and moves things, and that is where supply chain assurance has moved fastest. A tier one that has promised its own customer now has to evidence the tier below it, and the clause lands on a Staffordshire supplier who has held Cyber Essentials for three years and suddenly finds the self-assessment is no longer the answer. Plus is what the clause usually means.

Cyber Essentials is a verified self-assessment: you answer, an assessor marks it. Plus adds an independent technical audit on top, where somebody tests the machines rather than reading about them. When a buyer says the self-assessment is not enough, Plus is almost always what they mean.

What the audit meets in Staffordshire

Operational technology is the thing to raise before the audit rather than during it. Production lines, warehouse management systems, handheld scanners, vehicle terminals and industrial controllers are often tied to software the vendor stopped supporting, and often on the same flat network as the office. Plus tests the devices in scope, so the useful conversation is which of those are genuinely in scope, which are segregated, and whether that segregation holds when somebody tests it.

What usually costs a pass in Staffordshire

A production controller on the same flat network as the office, with no segregation to evidence
Shared logins on handheld scanners and vehicle terminals, which fail user access control outright
A warehouse management client pinned to an operating system that went out of support last year

None of these is unusual and none of them is a reason to delay. They are the things worth checking before you commit to a date, which is what a pre-audit review is for.

Sequencing

You need a valid Cyber Essentials certificate, less than three months old when the Plus certificate is issued, and 30 days to remediate anything the audit finds. We certify both, so an expired certificate is something we fix rather than something that sends you elsewhere. The main Cyber Essentials Plus page has the detail.

Local, and no handoff

Stafford, Cannock and Lichfield are half an hour from us at Albrighton and Stoke-on-Trent is under an hour, so an on-site day is a booking rather than an expedition. Audits are scheduled around production, including early starts and non-production days. The Lead Assessor who runs the audit is the person you speak to, and as an appointed Cyber Essentials Plus Certification Body we issue the certificate ourselves rather than passing it to a third party.

Common questions

Do you cover Staffordshire?

Yes. Stafford, Cannock and Lichfield are half an hour from us at Albrighton and Stoke-on-Trent is under an hour, so an on-site day is a booking rather than an expedition. We are an appointed Cyber Essentials Plus Certification Body, so the audit and the certificate both come from us.

Do I need Cyber Essentials first?

Yes, and it has to be less than three months old when the Plus certificate is issued. If yours has aged out or you do not hold it yet, we can certify that directly first.

What does the audit actually test?

An external vulnerability scan of your internet-facing addresses, an internal authenticated scan across a representative sample of user devices, and testing of every internet gateway and any server reachable by an unauthenticated user. On the sampled devices we check malware protection, patching inside fourteen days, enforced multi-factor authentication on cloud services, and that standard users cannot do administrator-only things.

What happens if we fail something?

You get 30 days to fix it and be retested. Most things found at audit are configuration rather than cost, and we tell you exactly what and why rather than handing you a score.

Can you audit without stopping the line?

Yes. We book around production, including early starts and non-production days. The scans are the only part with any load, and we agree the window with you in advance.

Can the audit be done remotely?

Often, yes. Remote testing covers most estates. Where the estate genuinely needs somebody on site, we do that too, and there is no travel charge in our coverage area.