Cyber Essentials Plus: what the hands-on assessment actually tests

Cyber Essentials is a self-assessment. Cyber Essentials Plus is the same control set with someone checking whether your answers were true. That difference is the entire value, and it is why some buyers - particularly in the UK public sector supply chain - specifically require Plus.

The five control areas

Both levels cover the same ground: firewalls and internet gateways, secure configuration, security update management, user access control, and malware protection. Nothing exotic - the scheme deliberately targets commodity attacks rather than sophisticated adversaries.

What the hands-on assessment adds

• Vulnerability scanning of internet-facing systems and a sample of end-user devices.
• Device sampling across your estate - checking patch levels, configuration and malware protection on real machines rather than on a form.
• Email and web testing - whether malicious file types actually reach a user and execute.
• Account separation checks - confirming administrative accounts are separate from day-to-day ones and that MFA is enforced where required.

The sampling is what catches people. A self-assessment describes the fleet you intended; sampling finds the four laptops running an old OS, the contractor machine nobody enrolled, and the one server excluded from patching because it broke last time.

Where organisations fail

1. Patch timeliness. The scheme expects high-severity updates applied within a short window. A device a few weeks behind fails.
2. Unsupported software anywhere in scope - an old operating system, an end-of-life browser, an unsupported database.
3. Scope gaps - BYOD, home working devices and cloud services omitted from the declared scope but genuinely in it.
4. Administrative accounts used for routine work, or without MFA.
5. Default configurations left in place on network equipment.

Note how many of these are inventory problems rather than security capability problems. Organisations usually know what good looks like; they do not know what is actually on the network.

Scope carefully and honestly

Scope can be the whole organisation or a defined subset, but a scope that conveniently excludes the messy part invites questions and may not satisfy the customer asking for the certificate. Whole-organisation scope is the strongest claim and the one most buyers assume.

Remember that cloud services and home-working devices are generally in scope. The scheme has moved to reflect how organisations actually work, and treating cloud as out of scope is a common and outdated assumption.

Preparing

1. Inventory first - you cannot pass on devices you do not know exist.
2. Verify patch status across the fleet, not on a sample you chose.
3. Find and remove unsupported software, or remove it from scope legitimately.
4. Separate administrative accounts and enforce MFA.
5. Run your own vulnerability scan and fix findings before the assessor does.

Is it worth the step up?

If a customer or framework requires it, the question is settled. Otherwise, the value is credibility - a verified certificate says something a self-assessment does not, particularly to buyers who know the difference. It is also considerably cheaper and faster than ISO 27001, which makes it a reasonable first step for smaller organisations rather than a competitor to it.

Key takeaways

• Plus verifies technically what the self-assessment asserts.
• Sampling finds inventory gaps more often than capability gaps.
• Cloud and home-working devices are in scope.
• Scan yourself before the assessor does.