Urgent Cyber Essentials Plus

What can be compressed, and what cannot

Being a Certification Body removes the part of the timeline most providers cannot control. There is no third party to book, no queue behind somebody else's queue, and no waiting for a certificate to come back from an organisation you have never spoken to. The audit is scheduled by the people who run it.

What cannot be compressed is the state of your estate. Cyber Essentials Plus is a technical audit of real machines, and an estate that does not meet the controls on the day does not pass because the deadline is tight. Anybody promising otherwise is either not doing the audit properly or is about to charge you twice. We would rather tell you that on the first call.

The three questions that decide your date

1. Do you hold a valid Cyber Essentials certificate, and how old is it? It has to be less than three months old when the Plus certificate is issued. If it has aged out, or you have never had it, that is a job in itself and it has to happen first. We certify Cyber Essentials directly, so it is a sequencing problem rather than a dead end, but it is the single most common reason an urgent Plus slips.
2. Is multi-factor authentication enforced on every cloud service that offers it? Not available, not encouraged, enforced. Since April 2026 this is an automatic fail rather than an observation, and rolling it out across a workforce is days of work, not hours.
3. Is anything in scope running past its end of support date, or more than fourteen days behind on high-risk and critical patches? A single unsupported machine in scope stops the certificate on the day it is issued, whatever the migration plan says.

If all three are clean, an urgent audit is genuinely quick. If one is not, the honest answer is that the remediation sets the date, and we will tell you roughly how long it takes rather than booking you in and hoping.

If the audit finds something

You get 30 days to fix it and be retested before the assessment has to be recorded as a fail. That is worth knowing before you book, because it changes the arithmetic on a tight deadline: a retest window inside the deadline is a safety net, and a retest window outside it is not. We will say which one you are looking at.

What the audit checks, so there are no surprises

An external vulnerability scan of your internet-facing addresses. An internal authenticated scan across a representative sample of user devices, usually around ten per cent. Every internet gateway, and any server reachable by an unauthenticated user. On the sampled machines: malware protection working, high-risk and critical updates applied inside fourteen days, multi-factor authentication genuinely enforced on cloud services, and standard user accounts unable to do things only an administrator should.

Your self-assessment also has to be finalised and unchanged before Plus testing starts, so the two cannot run in parallel. On an urgent job that ordering matters more than anything else.

When urgent is the wrong word

• The contract actually says Cyber Essentials, not Plus. Read the clause again. It happens more often than you would think, and it changes the price and the timeline completely.
• You know the estate will not pass. A pre-audit review first is faster in elapsed time than failing, remediating and retesting, and it costs less.
• Your Cyber Essentials expired months ago. That is two pieces of work in sequence. Tell us the real deadline and we will tell you whether both fit inside it.

Who runs it

The audit is carried out by an IASME Lead Assessor who also works as a CREST-certified penetration tester, which tends to make the conversation about what the controls actually stop rather than about ticking a box. As an appointed Cyber Essentials Plus Certification Body we issue the certificate ourselves, so on an urgent job nobody is waiting on anybody else.

Common questions