Introduction
Cyber Essentials Plus is often described as the audited version of Cyber Essentials. While that is broadly accurate, many business owners want to understand what that means in practice.
The starting point is the same. Both certifications focus on five key technical security controls that help organisations protect themselves against common cyber threats. The difference is that Cyber Essentials Plus includes independent testing by a qualified assessor to verify that the controls are actually working as intended, rather than relying solely on a self-assessment questionnaire.
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials is the UK Government-recommended cyber security standard designed for organisations of all sizes. It focuses on five core areas:
- Firewalls and internet gateways
- Secure configuration
- Security updates and patch management
- User access control
- Malware protection
Cyber Essentials Plus uses the same framework but adds independent technical verification, giving customers, suppliers, and stakeholders greater confidence that the controls are effective in practice.
It’s important to remember that Cyber Essentials Plus is not a complete information security strategy. It should form part of a wider security program that includes staff awareness training, incident response planning, risk management, and ongoing security monitoring.
What Does the Assessor Test?
The purpose of the assessment is to confirm that the security controls described in the self-assessment are genuinely implemented and operating correctly across the agreed scope.
Assessors are typically looking for evidence of:
- A clear inventory of in-scope devices, services, and networks
- Supported operating systems and applications
- Security patches applied within required timescales
- Appropriate user permissions and administrator controls
- Multi-factor authentication (MFA) where required
- Effective malware protection
- Secure device and system configurations
Strong security tools alone are not enough. Organisations must also demonstrate consistent deployment, accurate records, and a clear understanding of what is included within the assessment scope.
A Practical Preparation Plan
Preparing for Cyber Essentials Plus is often much easier when approached as a small project rather than a compliance exercise.
1. Define Your Scope
Identify every internet-connected device, cloud service, and business system that falls within scope.
2. Address Unsupported Technology
Replace or upgrade unsupported operating systems, software, or hardware before assessment.
3. Verify Security Controls
Review centrally managed security settings, including:
- Patch compliance
- Local administrator privileges
- Firewall configurations
- Endpoint protection
4. Review Identity Security
Check:
- Administrator accounts
- MFA coverage
- User permissions
- Cloud identity security
5. Conduct an Internal Review
Before the assessor begins testing, perform an evidence review to confirm that documented controls match your actual environment.
Don’t Prepare Using the Questionnaire Alone
Many organisations focus exclusively on completing the questionnaire, but successful certification depends on meeting the latest technical requirements as well.
Always review the current Cyber Essentials Requirements for IT Infrastructure alongside the latest assessment guidance, as requirements and scheme rules can change over time.
Common Challenges for SMEs
The biggest obstacles are rarely caused by a lack of security software.
More commonly, delays result from:
- Inconsistent device management
- Legacy or unsupported software
- Unmanaged home-working equipment
- Unclear ownership of systems
- Differences between documented controls and actual deployment
Treating certification readiness as an ongoing operational process rather than a once-a-year exercise helps reduce stress, improve security, and simplify renewals.
Frequently Asked Questions
Do I Need Cyber Essentials Before Cyber Essentials Plus?
Cyber Essentials Plus builds on the Cyber Essentials assessment. Organisations should confirm the current certification process with their chosen certification body before booking an assessment.
Is Cyber Essentials Plus the Same as a Penetration Test?
No. Cyber Essentials Plus verifies the implementation of specific Cyber Essentials controls within the agreed scope. A penetration test has a different objective and methodology.
How Often Should We Prepare?
Preparation should be continuous. Organisations that maintain effective patching, asset management, access reviews, and security monitoring throughout the year generally find certification and renewal significantly easier.
Need Help Preparing for Cyber Essentials Plus?
At Cyber Chameleon, we help organisations understand where they stand, identify gaps, and prepare for successful certification with practical advice and straightforward guidance.
Book a free consultation to discuss your Cyber Essentials journey and create a clear action plan.