How do I prepare Cyber Essentials Plus Certification?
How do I prepare Cyber Essentials Plus Certification?
Preparing for Cyber Essentials Plus Certification means going beyond completing the Cyber Essentials verified self-assessment. Cyber Essentials Plus uses the same core security requirements as Cyber Essentials, but an independent assessor also performs technical checks to confirm that your organisation has implemented those controls correctly.
This makes preparation especially important.
A business may believe that its security controls work because policies and management systems say they should. Cyber Essentials Plus gives an assessor the opportunity to test selected devices, internet-facing services, authentication arrangements, malware protection and security update management.
The current Cyber Essentials Requirements for IT Infrastructure are version 3.3, effective from 27 April 2026. The National Cyber Security Centre confirms that the five core controls remain firewalls, secure configuration, security update management, user access control and malware protection.
The currently published NCSC Cyber Essentials Plus Test Specification remains version 3.2 from April 2025. It explains the independent technical checks that assessors perform when verifying an organisation against the Cyber Essentials requirements.
UK Cyber Security Group provides Cyber Essentials certification and can support organisations preparing for Cyber Essentials Plus.
The best preparation starts by treating the Plus assessment as a real technical audit rather than an enhanced questionnaire.
Understand what Cyber Essentials Plus actually adds
Cyber Essentials and Cyber Essentials Plus assess the same five security controls.
The difference lies in assurance.
Cyber Essentials uses a verified self-assessment. Your organisation answers the assessment questions, a senior representative confirms that the information is accurate and an authorised assessor reviews the responses.
Cyber Essentials Plus adds independent technical testing.
IASME confirms that Plus includes an internal and external vulnerability assessment and technical checks across a representative sample of devices. Assessors also review internet gateways and servers that provide services to unauthenticated internet users.
This means you should prepare for somebody to verify the actual configuration rather than simply review your description of it.
If your assessment says users do not carry out normal work with administrator privileges, the assessor can test that.
If you state that cloud services use multi-factor authentication, the assessor can verify it.
If you state that security updates receive appropriate management, scanning may reveal whether high-risk vulnerabilities remain.
The practical nature of the assessment provides the main value of Cyber Essentials Plus.
Get Cyber Essentials first
Cyber Essentials Plus starts with Cyber Essentials.
IASME confirms that an organisation can use a Cyber Essentials verified self-assessment completed less than three months before the Plus certification without repeating that questionnaire stage.
This three-month period matters.
Do not complete Cyber Essentials and then leave Plus preparation indefinitely.
If Plus forms part of your objective, plan the technical audit alongside the original Cyber Essentials assessment.
A sensible route looks like this:
Complete your readiness review.
Correct technical weaknesses.
Complete Cyber Essentials.
Move directly into Cyber Essentials Plus preparation.
Book the Plus technical assessment.
Complete any final checks before testing starts.
This keeps the information used in the original assessment aligned with the environment that the Plus assessor will examine.
Make sure the assessment scope matches
Scope deserves attention before anything else.
The scope used for Cyber Essentials Plus needs to align with the scope of the associated Cyber Essentials certification.
The current test specification specifically requires the assessor to verify the assessment boundary before technical testing begins. It also requires verification of appropriate segregation when the Cyber Essentials scope covers a defined subset rather than the whole organisation.
Review your scope carefully.
Identify:
Company locations
Internet connections
Cloud services
Servers
Desktop computers
Laptops
Mobile devices
Remote workers
Contractors
Networks
Business services
Internet-facing systems
Do not discover during the audit that an entire group of devices should have formed part of the assessment.
Good asset records make this much easier.
Build an accurate device inventory
Cyber Essentials Plus uses technical sampling.
IASME states that assessors normally select a representative sample of the systems inside the Cyber Essentials scope and decide whether additional testing is necessary.
You therefore need to know what you operate.
Create an up-to-date device inventory that identifies:
Device name
User
Operating system
Operating system version
Business role
Location
Management status
Security update status
Administrator status
Do the same for servers and relevant infrastructure.
Do not assume the assessor will only select your newest or best-managed devices.
Prepare the whole environment.
A security weakness on one selected device can affect the technical assessment.
Review every operating system
Unsupported software creates a serious certification problem.
IASME states that organisations using unsupported software within Cyber Essentials scope cannot achieve certification.
Check every operating system in scope.
Do not simply record “Windows”, “macOS” or “Linux”.
Record the actual release and confirm that its vendor still provides security support.
Check:
Desktop operating systems
Laptop operating systems
Server platforms
Mobile operating systems
Network appliances where applicable
Virtual systems
Security appliances
Then check the applications running on those devices.
An application can become unsupported even when the operating system remains current.
Look for high-risk vulnerabilities before the assessor does
Security update management forms a major part of Cyber Essentials Plus testing.
The NCSC Plus test specification includes authenticated vulnerability checks on sampled devices. The purpose includes verifying that supported software has received required security fixes.
Run your own vulnerability assessment before the audit where possible.
Look specifically for:
Missing security updates
Unsupported software
Old browsers
Old productivity applications
Outdated utilities
Server vulnerabilities
Unpatched third-party applications
Network device weaknesses
Do not focus only on Microsoft products.
Third-party applications can create just as much trouble.
Browsers, PDF applications, remote access tools, development software and other commonly deployed applications all need attention.
Understand the security update requirement
Cyber Essentials requires organisations to manage security updates for supported software.
Cyber Essentials Plus then provides technical verification that helps determine whether the organisation meets those requirements in practice.
IASME’s guidance describes checks that confirm installed software remains supported and that relevant high and critical security vulnerabilities receive action within the required period.
Create a routine process.
Know how your organisation identifies missing updates.
Know who owns remediation.
Know how you identify devices that failed to receive an update.
Do not assume automated update management succeeds on every machine.
Verify the result.
Review all public IP addresses
The Plus assessment includes external vulnerability checking.
The assessor needs to understand your internet-facing infrastructure.
Create a reliable list of:
Public IP addresses
Internet gateways
Externally accessible servers
Remote access services
Relevant DNS records
Firewall interfaces
Cloud-hosted services under your management where applicable
IASME describes the external check as an assessment of public-facing systems to identify vulnerabilities and exposed services that an opportunistic internet attacker could discover.
Review your exposure before the assessment.
If an internet-facing service no longer serves a business purpose, remove the exposure.
If remote administration remains publicly accessible unnecessarily, restrict it.
If a firewall rule no longer has a valid purpose, clean it up.
Reducing unnecessary exposure strengthens security as well as certification readiness.
Check firewalls carefully
Firewalls remain one of the five Cyber Essentials controls.
Review internet gateways and device firewalls.
Make sure unnecessary inbound traffic remains blocked.
Review administrative access to network equipment.
Change default credentials.
Restrict management interfaces.
Check old rules.
Many organisations accumulate firewall rules over several years.
Someone creates temporary access for a project, but nobody removes it after the project ends.
Cyber Essentials Plus preparation provides a useful opportunity to clean those rules up.
Review secure configuration across every sampled device
Secure configuration aims to reduce unnecessary functionality that attackers could exploit.
Review employee devices and servers.
Remove software that nobody uses.
Disable unnecessary services.
Remove old accounts.
Change default credentials.
Check automatic screen locking.
Review local administrator membership.
Make sure security controls remain active.
Do not create one perfectly configured demonstration laptop and assume that will solve the audit.
The assessor selects a representative sample.
Consistency matters.
Separate administrator accounts from normal user accounts
Account separation forms part of Cyber Essentials Plus technical testing.
IASME describes a check where the assessor verifies that users on sampled devices cannot perform administrator functions through their normal everyday accounts.
This deserves a review before the audit.
Ask:
Which users have local administrator privileges?
Why do they need them?
Do technical employees use separate privileged accounts?
Do standard employees have administrator permissions unnecessarily?
Do temporary exceptions still exist?
Removing unnecessary administrator access significantly reduces security risk.
Malware running through an ordinary account usually has fewer opportunities than malware running with administrator privileges.
Review Microsoft 365 and other cloud services
Cloud applications form an important part of modern Cyber Essentials assessments.
Create a list of cloud services used by employees.
Examples may include:
Microsoft 365
Google Workspace
Accounting systems
CRM platforms
Project management services
File-sharing services
Support systems
Development platforms
HR platforms
For each service, identify users and administrators.
Then verify multi-factor authentication.
Do not rely on assumptions.
Check the service configuration.
Test MFA before the Cyber Essentials Plus assessor does
Current Cyber Essentials requirements give MFA particular importance for cloud services.
The Plus audit can include direct checks to confirm that sampled users receive an MFA challenge when accessing relevant cloud services. IASME states that the assessor can check standard and administrator access to the cloud services used by sampled devices.
Test this yourself.
Use a real user account.
Use an administrator account.
Try a fresh authentication session.
Check whether MFA actually appears.
Look for older authentication routes that could bypass modern controls.
Review service accounts separately where relevant.
A policy stating that the organisation uses MFA does not prove that every applicable cloud account receives the protection.
Pay special attention to Microsoft 365
Many UK organisations rely heavily on Microsoft 365.
Review:
Entra user accounts
Administrator roles
MFA
Dormant accounts
Guest users
Legacy authentication
SharePoint external sharing
OneDrive sharing
Contractor access
Employees who left
Shared mailboxes
Conditional Access where used
Cyber Essentials Plus can reveal gaps that ordinary Microsoft 365 use does not make obvious.
A user may have MFA on one account but not another.
A forgotten administrator may remain active.
A contractor may still have access after a project ended.
Preparation gives you the chance to correct these issues before the assessor tests the environment.
Check malware protection on endpoints
Malware protection forms another Cyber Essentials control.
The Plus assessment includes technical checks designed to determine whether malware defences prevent users from accessing malicious content.
IASME states that assessors can use safe test files delivered through email and web access to observe how the organisation’s protection responds. The files used for assessment are benign test files rather than real malware.
Before the assessment, confirm that endpoint protection remains active.
Check that employees cannot casually disable it.
Review whether protection receives updates.
Confirm that alerting works.
Check devices that spend long periods away from the corporate network.
Remote workers need the same protection as office users.
Test email protection
The Plus malware checks can involve email.
Review whether your email platform blocks or detects suspicious attachments appropriately.
Do not rely only on endpoint antivirus.
Modern protection often involves several layers:
Email security
Attachment scanning
Endpoint protection
Browser security
Application controls
User awareness
Make sure the layers actually work together.
If the email gateway allows a test item through, endpoint protection may still need to stop the user accessing it.
The technical audit looks at the practical outcome.
Test web protection
Assessors can also test malware protection through web activity.
Make sure users cannot freely execute unsafe content through browsers.
Review browser security.
Check endpoint protection.
Confirm that application controls operate where your organisation uses them.
Again, do not wait for the assessor to discover a gap.
Run appropriate internal checks beforehand.
Review mobile devices
Phones and tablets can fall inside Cyber Essentials scope when they access organisational services and data.
Create a record of relevant mobile devices.
Check:
Operating system support
Security updates
Device locking
Authentication
Cloud access
Company management controls where used
Rooted or jailbroken devices should not form part of a secure business environment.
Do not forget tablets simply because most employees use laptops.
Review contractor devices
Contractors can create an unexpected Plus assessment problem.
IASME guidance makes clear that devices used by contractors to access organisational information can become relevant to Cyber Essentials scope depending on how the organisation structures access.
You need a clear strategy.
The organisation might provide managed corporate equipment to contractors.
It might require the contractor organisation to hold appropriate certification.
Another approach may use controlled access methods that keep organisational data away from an unmanaged endpoint where scheme requirements allow.
Whatever approach you choose, understand it before defining scope.
Do not discover during Plus preparation that unmanaged contractor laptops should have received technical controls.
Prepare remote workers
Remote workers receive the same security expectations as office workers when their devices sit within scope.
Check:
Operating system support
Security updates
Endpoint protection
Local firewall
Administrator privileges
Device locking
Cloud MFA
Remote access arrangements
Remote workers should not become the forgotten part of the infrastructure.
Ensure that your management tools can identify whether their devices remain compliant.
Check internet gateways
IASME states that the Plus assessment includes internet gateways within the technical audit.
Review routers and firewalls.
Confirm that:
Firmware remains supported.
Administrative access uses secure credentials.
Remote administration remains restricted.
Unnecessary services stay disabled.
Firewall rules reflect current requirements.
Public exposure remains understood.
Document which gateway serves each location.
This makes the technical audit easier to coordinate.
Check servers exposed to internet users
Servers providing services to unauthenticated internet users receive particular attention in the Plus audit.
IASME specifically identifies these systems when describing the assessment scope.
Identify them before the audit.
Examples might include:
Public web services
Remote portals
Externally accessible business applications
Authentication gateways
Other externally reachable server services
Make sure security updates remain current and unnecessary services stay closed.
Run vulnerability checks before the assessor starts.
Carry out a mock assessment
One of the most effective ways to prepare involves performing an internal mock Plus assessment.
Select representative devices.
Do not select only your best systems.
Include a mixture of departments, operating systems and working arrangements.
Check each selected device for:
Software support
Security updates
Administrator separation
Malware protection
MFA
Firewall configuration
Relevant cloud services
Record failures.
Correct them.
Then test again.
A mock assessment gives you a much clearer picture of actual readiness than reviewing policies alone.
Do not assume Cyber Essentials automatically means Plus readiness
You may have successfully completed the Cyber Essentials questionnaire while still finding technical gaps during Plus preparation.
IASME explains that Cyber Essentials Plus uses the same requirements but provides a higher level of assurance because an independent party tests implementation.
This distinction matters.
A Cyber Essentials response might accurately describe your intended organisation-wide process.
The Plus assessment checks whether sampled systems reflect that process.
Treat the technical audit as verification, not as a formality.
What are the key requirements for achieving Cyber Essentials certification?
The five core controls remain:
Firewalls
Secure configuration
Security update management
User access control
Malware protection
These controls form the foundation for both Cyber Essentials and Cyber Essentials Plus.
The current Requirements for IT Infrastructure v3.3 became effective on 27 April 2026. Organisations that began their assessment before that date can continue under the previous applicable requirements.
For Plus preparation, do not merely confirm that these controls exist.
Make sure the technical environment demonstrates them consistently.
How can I prepare my small business for Cyber Essentials assessment?
A small business should begin with an accurate picture of its IT environment.
List devices.
List cloud services.
Identify operating systems.
Check software support.
Review user accounts.
Identify administrators.
Confirm MFA.
Review security updates.
Check endpoint protection.
Review firewall configuration.
Then complete the Cyber Essentials question set before beginning the formal submission.
The NCSC makes the current assessment questions available so organisations can identify gaps before entering information into the certification portal.
Small businesses do not need complicated security administration.
They do need consistent controls.
A five-person organisation can fail a Plus technical check just as easily as a larger business if one selected laptop remains unpatched or one cloud account lacks MFA.
Know what happens during sampling
IASME states that the assessor tests a suitable representative sample and commonly starts with around ten per cent of relevant systems, then determines whether further testing is necessary.
Do not interpret sampling as permission to secure only part of the organisation.
The sample provides evidence about the wider environment.
If selected machines repeatedly show inconsistent management, the assessor may need additional testing.
Your preparation therefore needs to cover the whole scope.
Check each operating system group
IASME’s published Plus guidance explains that device sampling needs to represent the operating systems used within the organisation.
If you operate Windows and macOS, prepare both environments.
If mobile platforms also form part of scope, prepare them too.
Do not assume that success on one platform proves that another receives equivalent management.
Different management processes can create different weaknesses.
Keep technical evidence ready
The Cyber Essentials Plus assessor performs technical testing, but good documentation still helps.
Keep accurate records of:
Devices
Users
Operating systems
Public IP addresses
Cloud services
Administrators
Update management
Endpoint security
Network gateways
Server roles
Scope decisions
Contractor arrangements
This information allows your Certification Body to plan the assessment effectively.
It also reduces delays caused by inaccurate scope information.
Give your technical team advance notice
The audit may require cooperation from employees and technical personnel.
The assessor may need sampled users available to perform normal tasks while checks take place.
Arrange availability.
Make sure employees understand that the audit may require them to authenticate, access cloud services or demonstrate account behaviour.
The IT team may need to provide information about endpoints, internet gateways and servers.
Planning this beforehand helps the audit run efficiently.
Do not make last-minute configuration changes without testing
Businesses sometimes react to an upcoming audit by making many security changes at once.
That can create new problems.
A hurried firewall change may interrupt a business service.
Removing administrator rights may expose an application that wrongly depends on elevated access.
Turning on MFA without testing can affect an old integration.
Prepare early enough to implement improvements properly.
Make the change.
Test it.
Confirm that normal business operations still work.
Then move forward.
Understand remediation
Cyber Essentials Plus expects successful technical verification of the applicable requirements.
IASME guidance explains that when technical testing identifies a problem, the organisation needs to remediate it before achieving Plus. Previous IASME guidance describes a remediation period of up to 30 days for Plus findings.
Do not plan to use remediation as your normal preparation strategy.
The aim should be to enter the technical audit ready to pass.
Remediation exists to address findings, not to replace readiness work.
What software solutions support compliance with Cyber Essentials standards?
No single software platform guarantees Cyber Essentials Plus certification.
Useful services may include:
Endpoint management
Patch management
Asset inventory
Identity management
Multi-factor authentication
Endpoint security
Vulnerability management
Mobile device management
Security monitoring
Cloud administration
These technologies can help you manage the five core controls consistently.
Microsoft Entra can support identity and authentication.
Microsoft Intune can support managed endpoints.
Endpoint security platforms can support malware protection.
Vulnerability scanners can identify missing security fixes.
Asset tools can identify devices you may otherwise forget.
The key is correct management.
A security tool that nobody monitors does not automatically create compliance.
Current UK figures support stronger technical assurance
The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months. That represents approximately 612,000 UK businesses.
The rate reached 65 per cent among medium businesses and 69 per cent among large businesses. Small businesses reported 46 per cent.
Phishing remained the most common reported attack and affected 38 per cent of businesses. Among organisations that identified a breach or attack, 29 per cent said they experienced incidents at least weekly.
Cyber Essentials adoption also increased.
Government management information shows that 59,090 Cyber Essentials certificates were awarded between April 2025 and March 2026. Of those, 14,482 were Cyber Essentials Plus certificates.
The government survey also reported that the proportion of businesses holding Cyber Essentials increased from 3 per cent to 5 per cent, with particularly strong growth among small and large businesses.
These figures show growing demand for demonstrable cyber security assurance.
Cyber Essentials Plus can support supply-chain assurance
Cyber Essentials Plus can provide customers with stronger assurance because an independent assessor has technically verified the controls.
IASME describes Plus as a higher-assurance version of the same Cyber Essentials requirements.
This can matter where customers handle sensitive information or depend heavily on suppliers.
Some organisations now ask suppliers to maintain Plus certification as part of their cyber security expectations.
The 2025 to 2026 government survey found that 3 per cent of all businesses required suppliers to hold Cyber Essentials, rising considerably among larger organisations.
For businesses seeking government, defence or larger commercial supply-chain work, Plus can therefore provide value beyond internal security improvement.
Can I renew my Cyber Essentials certification through an online service?
Yes.
Cyber Essentials uses an online verified self-assessment process, and organisations need annual recertification to maintain a current certificate.
IASME confirms that Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months.
For Plus, you should plan annual technical reassessment rather than assuming last year’s result remains sufficient.
Technology changes quickly.
Employees join and leave.
Devices change.
Cloud services appear.
Operating systems receive updates.
Software reaches end of support.
Administrator permissions change.
Annual reassessment provides a useful opportunity to verify that the organisation has maintained the controls.
Keep records from the previous assessment, but review every answer again.
Plan renewal before the certificate expiry date
Do not leave annual renewal until the final few days.
Remember that Cyber Essentials Plus depends on the underlying Cyber Essentials stage.
IASME confirms that organisations need to enter their current information again when they recertify because this creates an annual review of their security position.
Start early enough to identify issues.
Check:
New equipment
New cloud services
Changed public IP addresses
New employees
Former employees
Contractors
Operating system support
MFA
Security updates
Malware protection
Administrator rights
This makes annual Plus certification significantly easier.
Which companies provide Cyber Essentials certification services in the UK?
Cyber Essentials certification comes through authorised Certification Bodies operating within the IASME delivery framework.
UK Cyber Security Group provides Cyber Essentials certification and support for businesses seeking the Government-backed certification.
When you want Cyber Essentials Plus, make sure the Certification Body can provide the required technical assessment.
A good provider should explain:
The scope
The preparation process
The technical assessment
Sampling
Required information
Potential remediation
Annual renewal
Businesses with mixed cloud, remote working and contractor environments may particularly benefit from working with a provider that understands modern infrastructure.
Which UK-based firms offer Cyber Essentials consultancy services?
Many UK cyber security companies provide Cyber Essentials consultancy and readiness support.
UK Cyber Security Group provides Cyber Essentials certification together with wider cyber security services.
For Cyber Essentials Plus, effective consultancy should focus on technical readiness rather than questionnaire wording alone.
Useful support may include:
Scope review
Asset verification
Vulnerability assessment
Security update review
MFA checks
Administrator privilege review
Endpoint security checks
Firewall review
Cloud security review
Mock Plus testing
Remediation support
The objective should be to make the actual environment compliant before the assessor begins the technical audit.
A practical Cyber Essentials Plus readiness checklist
Before your Plus assessment, check the following:
- Your current Cyber Essentials certification remains within the required timeframe for moving to Plus.
- Your Cyber Essentials and Plus scopes match.
- You have an accurate inventory of devices.
- You know every operating system in use.
- All operating systems remain supported.
- Relevant applications remain supported.
- Security updates receive appropriate management.
- You have run vulnerability checks where appropriate.
- Public IP addresses have been identified.
- Internet gateways have been reviewed.
- Internet-facing servers have been checked.
- Unnecessary exposed services have been removed.
- Device firewalls remain active.
- Unnecessary software has been removed.
- Standard users do not have unnecessary administrator privileges.
- Technical employees use appropriate account separation.
- Relevant cloud services have been identified.
- MFA operates across applicable cloud services.
- Administrator cloud accounts receive MFA.
- Malware protection remains active.
- Email protection works.
- Web protection works.
- Mobile devices meet the requirements.
- Remote worker devices remain managed.
- Contractor access has been reviewed.
- The device sample will represent the wider environment.
- Technical staff know when the assessment will occur.
- Sampled users can support testing.
- Asset and network information remains available to the assessor.
- You have completed your own readiness checks before formal testing.
If several of these areas remain unclear, address them before the audit.
Treat Plus preparation as a technical health check
The best answer to How do I prepare Cyber Essentials Plus Certification? is to prepare the entire environment rather than trying to predict which systems the assessor will select.
Start with a current Cyber Essentials assessment.
Confirm the scope.
Build an accurate asset record.
Check software support.
Find and remediate security vulnerabilities.
Review public-facing services.
Check firewalls.
Remove unnecessary administrator access.
Verify MFA.
Test cloud services.
Check endpoint protection.
Review remote workers.
Understand contractor access.
Run your own representative checks.
Then proceed to the technical assessment.
Cyber Essentials Plus uses the same five core security controls as Cyber Essentials but adds independent technical verification. IASME states that this additional audit provides a higher level of assurance that organisations have implemented the controls correctly.
The practical value extends beyond certification.
Preparing thoroughly can identify forgotten accounts, unsupported software, weak authentication, missing security updates and unnecessary internet exposure before an attacker discovers them.
UK Cyber Security Group provides Cyber Essentials certification and cyber security support for organisations that want help preparing their systems and demonstrating compliance with the Government-backed scheme.
Cyber Essentials Plus should not feel like a test that you hope to pass. The strongest approach is to make the five controls part of normal IT management throughout the year. When devices remain supported, vulnerabilities receive attention, users have appropriate permissions, MFA protects cloud services and malware defences operate consistently, the annual technical assessment becomes confirmation of a security position the organisation already maintains.
UK Cyber Security Group Ltd is here to help
Please check out our Free Cyber Insurance
Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,
If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us
