Cyber Essentials Plus Preparation and Audit Support

What the assessor actually tests

Cyber Essentials Plus is not a longer questionnaire. An assessor takes a representative sample across your device types — laptops, desktops, servers where in scope, and mobile devices — and tests them directly. Authenticated vulnerability scanning looks for missing patches and unsupported software on the actual machines rather than trusting your description of them.

They then test that malware protection works in practice by attempting to download and execute benign test files and reach test web content, and they verify that standard user accounts cannot install software, that administrative accounts are separate, and that multi-factor authentication is enforced on cloud services.

• ✓Authenticated vulnerability scan of sampled devices
• ✓Malware protection tested against email and web-delivered test files
• ✓Verification that standard users cannot install software
• ✓Separation of administrative accounts from everyday accounts
• ✓MFA enforcement checked on in-scope cloud services

The fourteen-day patch rule is where people fail

The rule is specific: high-severity and critical updates must be applied within fourteen days of release. The scan will find anything outside that window, including third-party software people forget about — browsers, PDF readers, Java runtimes, conferencing clients, and the plugin somebody installed for one project.

This is why we scan before the assessor does. Running the same authenticated scan a fortnight ahead turns a potential failure into a maintenance task, and gives you time to deal with anything that needs a vendor conversation rather than a click.

• ✓Operating system updates, including feature versions still in support
• ✓Browsers and their extensions
• ✓Third-party applications — readers, runtimes, conferencing, utilities
• ✓Firmware on in-scope devices where the vendor issues security updates
• ✓Mobile operating system versions past vendor support

Timing matters

Cyber Essentials Plus must be completed within three months of your Cyber Essentials certification. Missing that window means recertifying at the basic level first, which costs time and money for no benefit.

We plan both together from the outset: gap review, remediation, Cyber Essentials certification, pre-audit scan, then the Plus assessment — with the deadline built into the schedule rather than discovered late.