Check your readiness
CE Plus · Preparation

How to prepare for Cyber Essentials Plus

The remediation order that gets organisations through Cyber Essentials Plus first time: patch first, MFA second, admin separation third, then malware protection, then external exposure, with the evidence to have ready on the day.

By Precursor Security, an IASME Certification BodyUpdated 22 September 2026
Short answer

Prepare for Cyber Essentials Plus in the order the audit fails people: retire unsupported software and close every critical or high update older than 14 days; enforce MFA on every cloud service for every user; remove administrator rights from daily accounts; confirm anti-malware is running and updated; then close exposed services. Audit within three months of certification.

Key facts
Order
1. Patching 2. MFA 3. Admin separation 4. Malware protection 5. External exposure
Window
Plus completed within 3 months of your last Cyber Essentials certification, same scope (IASME)
Typical timeline
With Precursor: 2 to 3 weeks (up to 50 devices), 2 to 4 weeks (50 to 250 devices), 3 to 5 weeks (250+ devices)
Retest
Precursor re-tests after remediation at no additional cost within 90 days
Checklist
The CE Plus checklist lists every test with the evidence to gather

Why this order?

Each step in the order maps to a test case, and the order follows a typical pattern of where first-attempt fails come from. Patching (Test 2) often comes first, because it touches every sampled device and the 14-day rule leaves no margin. MFA (Test 4) is next: it is binary, and one unenforced administrator is a fail. Account separation (Test 5) is quick to fix but easy to forget on older builds. Malware protection (Test 3) usually passes on managed estates and fails on the unmanaged corner. External exposure (Test 1) is last because a firewall rule review takes an afternoon.

Work through the steps in this order and the Plus audit becomes a confirmation rather than a discovery exercise.

Step 1: how do you close the patching gap?

  • Build the device inventory from your management tool and reconcile it with A2.6 to A2.8. Every device on it is a candidate for the sample.
  • Find unsupported operating systems and applications and remove them, upgrade them, or isolate them in an internet-blocked sub-set (A6.7). Virtual patching does not count.
  • Run an authenticated vulnerability scan across the estate. Fix every finding rated critical or high, CVSS v3 7 or above, or unrated, where the fix is older than 14 days.
  • Enforce restart deadlines. 'Pending restart' is 'missing' to the scanner.
  • Cover third-party applications and firmware, not only the operating system.
  • Re-scan and keep the clean report as evidence for A6.4.2 and A6.5.2.

Step 2: how do you enforce MFA everywhere?

  • List every cloud service from A2.9, including the ones with their own logins (accounting, HR, CRM, DNS, domain registrar, file transfer).
  • Enforce MFA by policy for all users and all administrators, with no location or device exemptions that would let the assessor's incognito session through.
  • Register a method for every account and report on accounts without one.
  • Sign in as a standard user and as an administrator from an incognito window on every authentication service, and confirm the prompt appears before any data loads.
  • For any service with no MFA support, record it in A7.15 and plan its replacement.

Step 3: how do you separate administrator accounts?

  • Remove daily-use accounts from the local Administrators group on Windows and the admin group on macOS, enforced by policy.
  • Create named administrator accounts for the people who need them, used only for administrative tasks, with MFA.
  • Keep the administrator register current (A7.8) and review it (A7.9).
  • Test on each build: log in as an ordinary user and try to install software. Your own password must not get you through.

Step 4: how do you confirm malware protection?

  • Check the anti-malware console for every sampled platform: agent installed, running, definitions current, real-time and web protection on.
  • Alert on devices that have not reported in, and fix them before the audit.
  • Disable auto-run and automatic execution of downloads (A5.8).
  • Send an inert test file from an external mailbox and confirm it is blocked; download one through a browser and confirm the same.
  • For allow-listing, confirm an unsigned executable is refused on each sampled build.

Step 5: how do you close external exposure?

  • List every public IP address and IaaS instance (A2.5).
  • Run an external scan on that list and fix every finding that scores 7.0 or more, whatever its age, especially on firewall, VPN and router firmware.
  • Remove every inbound rule without a documented business need, and document the rest (A4.8).
  • Take management interfaces off the internet or protect them with MFA or an IP allow list (A4.9 to A4.11).

What should you have ready on the day?

  • The self-assessment certificate and scope statement.
  • The device inventory, public address list and cloud service list, all matching the A2 answers.
  • Named users at each sampled device with working email and browser, and their MFA method to hand.
  • One standard user and one administrator account per cloud service.
  • Administrator credentials or agent access for the authenticated scan.
  • Console access to your anti-malware and identity platforms for the manual checks.
  • Signed written authorisation for the scan and the test files.

How do assessors check this?

How assessors check this
Assessors see the same three causes of first-attempt failure again and again: an unsupported operating system on one sampled device, an administrator account that reaches the cloud console without an MFA prompt, and a standard user who is also a local administrator. All three are visible in your own management tooling before the audit. The audit is not the place to discover them.
Common failure: Preparing the sample instead of the estate
IT picks the ten newest laptops, patches them by hand, and presents them as the sample. The assessor draws the sample from the full inventory instead and lands on a three-year-old device in reception that has never been enrolled in management. It fails Tests 2, 3 and 5 in one sitting. Fix: prepare every device in scope, because the sample is the assessor's choice and the 2026 rule adds a new random sample to any retest after an update management fail.

Related pages

Frequently asked questions

An estate that already meets the self-assessment honestly often needs one to two weeks of remediation. Precursor's published turnaround from scoping to certificate is 2 to 3 weeks (up to 50 devices), 2 to 4 weeks (50 to 250 devices), 3 to 5 weeks (250+ devices). Estates with unsupported software or no MFA enforcement take longer, because the fixes take longer than the audit.

The self-assessment must be certified first, and IASME says the Plus audit can then be completed within 3 months of that certification, on the same scope. Booking both together and running the Plus audit shortly after the self-assessment is certified avoids missing the window.

If you are unsure about patching, MFA or admin separation, yes. A gap analysis runs the same scans and checks the assessor will run, and the fixes then happen before the audit rather than in a retest.

A management tool that can report OS versions, update compliance and local administrator membership; an identity platform that can enforce MFA; an anti-malware console; and access to a vulnerability scanner or a partner who can run one.

Yes. The Cyber Essentials Plus checklist lists every test case with the evidence to gather and the self-assessment question it verifies.

Free checklist

Work through the checklist

All five controls and all 106 Danzell questions, question by question, with the evidence an assessor asks for on each.

Open the checklistCheck your readiness
  • IASME Certification Body
  • CREST accredited
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources