Cyber Essentials Plus

How does Cyber Essentials Plus apply to Cyber Essentials?

In plain terms

Basic Cyber Essentials is like filling in a form that says your doors are locked. Plus is someone coming round and trying the handles. The controls are the same. The difference is that an assessor checks them with their own tools and watches your staff use real devices.

What the test specification asks

Before testing, the assessor must confirm that the Plus scope "matches the scope described by the valid Cyber Essentials self-assessment certificate" and pick a representative sample of devices and cloud accounts. The five test cases are a remote vulnerability scan of your internet-facing addresses, an authenticated scan for missing patches, malware protection checks using test files, a check that cloud services ask for multi-factor authentication, and a check that standard users cannot run admin tasks. Every sub-test must pass. The only exception is at the Delivery Partner's discretion, for marginal deviation in less than 5% of tests where the evidence does not point to a wider failure.

Common mistakes

Patching the operating system but missing third-party apps such as browsers and PDF readers, which the authenticated scan finds. Booking the audit late and running out of the three-month window after the self-assessment pass. Leaving fixes until the audit: failed test cases are fixed and then retested, which adds time. See retest.

See the Cyber Essentials Plus overview, the pass and fail rules and Cyber Essentials.