How Cyber Essentials Plus differs
With Cyber Essentials an assessor reviews your answers. With Cyber Essentials Plus, they test. You need a current Cyber Essentials certificate first, and the Plus audit must normally be completed within three months of that certification.
Because Plus is evidence-based, it is the level larger customers and many public-sector buyers prefer.
What the assessor typically checks
- An external vulnerability scan of your internet-facing IP addresses
- Internal vulnerability scans on a sample of devices
- Patch status of operating systems and applications on sampled devices
- Malware protection, including tests that malicious files and email attachments are blocked
- Multi-factor authentication on in-scope cloud services
- Separation of admin accounts from everyday user accounts
Our Cyber Essentials Plus requirements page goes through each test and how to prepare.
Preparing for a smooth audit
We run the same kind of checks before the assessor arrives, fix what we find and keep evidence ready. That usually means pushing outstanding updates, removing unsupported software, tightening email filtering and confirming MFA everywhere it is available. Endpoint protection such as Sophos Intercept X or Cisco Secure Endpoint and DNS filtering such as Cisco Umbrella make the malware tests much more predictable.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers, and patches that sit for weeks. We find those gaps before an assessor does.
- Readiness review of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider; we prepare you for certification and work alongside a licensed certification body, which issues the certificate.
Want to know how close you are to passing?
Talk to Forever Systems on 0333 358 3808 or send us an enquiry and we will come back to you with options, not a hard sell.
Call 0333 358 3808Send an enquiryFrequently asked questions
Do I need Cyber Essentials before Cyber Essentials Plus?
Yes. Cyber Essentials Plus builds on a current Cyber Essentials certificate, and the technical audit normally has to take place within three months of it.
Is the Cyber Essentials Plus audit done on site?
Assessments can be carried out on site or remotely depending on the certification body and your setup. Either way, the assessor tests a sample of real devices and accounts.
How much does Cyber Essentials Plus cost?
It depends on the number of users, sites and devices in scope, and on the certification body. See our cost guide for the factors that drive the price.