Fast Cyber Essentials Plus

If you have a deadline and you need Cyber Essentials Plus rather than Cyber Essentials, the first thing worth saying is that the two are not comparable on speed. Cyber Essentials is a questionnaire that an assessor reviews. Plus is a technical audit of a sample of your devices, carried out by an assessor at a booked time. There is no version of that which happens this afternoon, and anyone implying otherwise is selling you something they cannot deliver.

What you can shorten is everything either side of the audit. That is usually where the weeks go.

What actually sets the timeline

Four things, in the order they bite.

Your Cyber Essentials certificate. Plus cannot be awarded without it, and the certificate has to be no more than three months old when the Plus assessment completes. If you do not hold current Cyber Essentials, that is the first task rather than a formality. We are an appointed Certification Body and assess submissions within one business day as standard, so this part does not have to be the bottleneck. More on that on the Fast Cyber Essentials page.

A slot in an assessor's diary. This is the part that cannot be compressed by paying more. An audit needs an assessor and an agreed window with your people available. Booking early is the whole of the trick.

Your estate being ready. The audit samples devices and tests whether the controls hold in practice. If patching is behind or multi-factor authentication has exceptions, the audit finds it, and you are then in remediation rather than certification. This is the most common cause of a Plus running over.

Remediation and retest, if needed. Where something fails, you fix it and the relevant part is retested. Budget for the possibility rather than assuming it away.

Our dates

We assess Cyber Essentials Plus from late October 2026 and slots are open to book now. Booking ahead of the date you need is the single most useful thing you can do, because the constraint is calendar rather than capacity.

If your Cyber Essentials is not in place yet, we can certify that with us first and you go into the audit without a handoff to another provider in between.

What to do before the audit

Most Plus failures come from the same handful of things, and all of them are checkable in advance:

Patching. Operating systems and applications within the scheme's timescales, including browsers and anything with a plug-in.
Multi-factor authentication on cloud services, with no standing exceptions. Pull the list from your tenancy rather than asking whether anyone has been excluded.
Accounts. Leavers removed, administrator rights separated from day-to-day accounts, default passwords gone.
Unsupported software. Either removed, or genuinely segregated and out of scope. Described segregation is not the same as real segregation.
Device sample. Know which machines represent your estate, because the audit will sample across your operating systems and build types.

A gap analysis before the audit is worth it where the estate is mixed or nobody is certain of the current state. It is not worth it if you already have a managed, patched fleet and good records.

When Plus is not what you need

Plenty of organisations ask for Plus because a customer used the phrase, when the requirement is actually Cyber Essentials. Plus costs more, takes longer and tests more, which is appropriate when somebody has specifically asked for it or your risk genuinely calls for it, and is wasted effort when they have not.

We will tell you which one your situation calls for, including when the answer is the cheaper one. The difference between the two is set out on Cyber Essentials vs Cyber Essentials Plus.

Who does the audit

We are an appointed IASME Certification Body, so the assessment and the certificate come from us rather than being passed to a third party. The audit is carried out by a qualified assessor who also works as a CREST-certified penetration tester, which tends to make the conversation about what the controls actually stop rather than about ticking a box.

If testing and certification are both on your list, they can be scoped together. Details on the Cyber Essentials Plus page and under penetration testing.

Book a Cyber Essentials Plus slot

Tell us your deadline and roughly what your estate looks like, and we will tell you whether it is achievable and what it costs. If Cyber Essentials needs doing first, we can do that directly rather than sending you elsewhere.

Common questions

How quickly can Cyber Essentials Plus be done?

Faster than most people are told, but not instantly. The audit has to be booked and attended, so the realistic path is Cyber Essentials certified first, a slot booked, and the estate checked before the assessor arrives. Where an organisation is already well managed, the limiting factor is the diary rather than the work.

Do we need Cyber Essentials before Cyber Essentials Plus?

Yes. The Plus assessment cannot be awarded without a current Cyber Essentials certificate, and that certificate must be no more than three months old when Plus completes. If you do not hold it, that is the first step and we can do it directly.

What happens if we fail part of the audit?

You fix what failed and the relevant part is retested. It is not a pass or fail verdict on the organisation. The common causes are patching behind the scheme's timescales and multi-factor authentication exceptions that nobody had reviewed.

Can you do the audit remotely?

In most cases, yes. The assessment samples devices and can be carried out remotely where your estate and your people allow it. Some situations are easier on site and we will say so rather than make it awkward.

Is Plus worth it over Cyber Essentials?

It depends who is asking. Plus is the same five controls with independent technical verification rather than self-assessment, so it carries more weight with insurers, primes and corporate clients. If nobody has specifically asked for Plus, Cyber Essentials is usually the proportionate answer.