Cyber Essentials Plus Preparation

Being clear about our role

We are a certified Cyber Essentials assessor. We are not a Cyber Essentials Plus assessor — the Plus audit itself must be carried out by a certification body licensed to deliver it.

What we do is get you ready for it: run the same technical checks in advance, fix what would fail, and make the assessment a formality. We can also help you find a Plus assessor if you don't already have one.

What Plus adds

Cyber Essentials is a self-assessment. You state that you meet the controls, and your answers are marked. Cyber Essentials Plus takes the same five controls and verifies them technically — an assessor examines a representative sample of your actual devices and confirms reality matches the declaration.

That distinction is why an increasing number of contracts specify Plus. A self-assessment relies on the person completing it knowing what is true; Plus does not.

What the assessment involves

Vulnerability scanning of a sampled set of end user devices and servers, checking for missing high and critical severity patches within the required timeframe.
External vulnerability scan of your internet-facing IP addresses.
Malware protection testing — verifying protection is present, active and effective against test files delivered by email and web download.
Account separation checks — confirming users do not routinely operate with administrative privileges.
Multi-factor authentication verification on cloud services.

Devices are sampled across your estate — different operating systems, different user groups, home and office workers. You do not choose which devices; sampling is designed to be representative.

Where organisations fail

Plus has a materially higher failure rate than Cyber Essentials, and the causes are consistent:

Patching. High and critical vulnerabilities must be remediated within fourteen days. Third-party software — browsers, PDF readers, Java, conferencing clients — is the usual culprit rather than the operating system.
Unsupported software. One machine still running an end-of-life operating system, or an old application nobody realised was installed.
Administrative accounts. Users doing daily work in an account with local admin rights, typically because an old line-of-business application required it.
Devices nobody remembered. A laptop in a drawer, a remote worker's machine, something that has not connected in months and is therefore months behind on updates.

How we prepare you

We run the technical checks before your assessment, on your real estate, so any failure happens in a dry run rather than in front of the assessor. That means scanning your devices, checking patch levels against the fourteen-day requirement, verifying malware protection behaves as expected, and identifying the machines you have forgotten about.

If something will fail, you find out while there is still time to fix it — and a failed Plus assessment costs both the fee and the delay.

Getting your Cyber Essentials first

You must hold valid Cyber Essentials before Plus, and it must be recent. That part we can certify directly, as a certified Cyber Essentials assessor. Most organisations do both together: we certify the Cyber Essentials, prepare you technically, and you go into the Plus assessment knowing it will pass.

Common questions

Can you certify us for Cyber Essentials Plus?

No. We are a certified Cyber Essentials assessor, not a Cyber Essentials Plus assessor — the Plus audit must be carried out by a certification body licensed for it. We certify your Cyber Essentials, prepare you technically for Plus, and can point you to a Plus assessor.

Do we need Cyber Essentials before Plus?

Yes. You must hold a valid Cyber Essentials certificate, and Plus must be completed within three months of it. We can issue the Cyber Essentials certification directly, which is usually done alongside the Plus preparation.

How many devices will be tested?

A representative sample based on the size and diversity of your estate — different operating systems, different roles, office-based and remote workers. Small organisations may see only a handful tested; larger estates proportionally more. You do not choose which.

What if we fail?

You will be told what failed and given a chance to remediate, though timescales and any additional cost depend on the certification body. It is largely avoidable, which is the entire point of testing beforehand.

Our staff work from home on their own devices. Does that matter?

Considerably. Devices used to access organisational data are generally in scope, including personally owned ones under BYOD. This is one of the more common scoping problems and worth resolving before you start rather than during assessment.