Cyber Essentials Plus: what it is and when you need it
If a customer or tender has asked for “Cyber Essentials Plus”, you probably want a straight answer: what is it, how is it different, and how much hassle is it? Here is the short version.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is a UK Government-backed scheme, run with the National Cyber Security Centre (NCSC) and delivered by IASME. It checks that you have five basic controls in place: firewalls, secure configuration, user access control, malware protection and software updates.
There are two levels:
- Cyber Essentials is a self-assessment. You answer a detailed questionnaire about your organisation, and a certifying body reviews it.
- Cyber Essentials Plus covers the same five controls, but someone independent tests them. Instead of taking your word for it, an assessor checks your systems directly.
Both certificates are valid for 12 months.
What happens in a Plus assessment
The assessor tests a sample of your devices and your internet-facing systems. Typically that includes:
- an external vulnerability scan of your public IP addresses
- checks on a sample of laptops, desktops and mobile devices, such as whether updates are installed and malware protection is working
- tests that confirm your devices block malicious email attachments and websites in the way you said they would
- a review that your in-scope cloud services use multi-factor authentication
The assessor looks at what is actually happening, not what the policy says should happen. That is why it carries more weight with buyers.
When do you need it?
Ask yourself three questions.
Does a customer or contract require it? Some public sector, defence and supply chain contracts ask for Cyber Essentials Plus rather than the basic level. Read the tender wording carefully. If it says “Cyber Essentials”, the basic certificate usually satisfies it. If it says “Plus”, it does not.
Do you hold data other people care about? Local authorities, charities, schools, law firms and finance teams often hold sensitive records. A technical test gives you, and them, more confidence.
Do your insurers or board want evidence? An independent test is easier to present than a questionnaire.
If none of these apply, start with the basic certificate. You can move to Plus later.
Timing and getting ready
The basic certificate comes first. Cyber Essentials Plus builds on it, and the technical audit has to be completed within a limited window after the basic certificate is awarded. confirm the current IASME time limit and the Unite process and timelines before publishing
Most failures come from the same few things:
- Unsupported software. Old operating systems, or software the vendor no longer patches, will fail.
- Missing updates. Critical and high-risk patches need to be applied within 14 days of release.
- Weak access control. Shared admin accounts, and cloud services without multi-factor authentication, will be picked up.
- A fuzzy scope. Decide up front which devices, networks and cloud services are in scope. A clear scope makes the test faster and cheaper.
A tidy, managed environment passes more easily. If your devices are patched automatically and protected with endpoint detection and response (see our guide on EDR vs antivirus), most of the work is already done.
Who can certify you?
Only certifying bodies licensed by IASME can assess and issue Cyber Essentials certificates. The Unite Group is a certifying body, so we guide you through the scope, the questionnaire and any fixes. confirm how Cyber Essentials Plus testing is delivered
What next?
If you are weighing it up, start with our Cyber Essentials service page for the process and pricing. If you want to see how certification fits with everything else you should be doing, our cyber security hub pulls it together. And if you are about to review your backups at the same time, read backups and business continuity next.
When you are ready, talk to us about Cyber Essentials.
