Cyber Essentials Plus checks the same five controls as Cyber Essentials, but an assessor tests them instead of relying on your answers. Larger customers, defence primes and insurers increasingly ask for it. The Plus audit must be completed within three months of achieving Cyber Essentials, so plan the two together.
What the assessor tests
- An external vulnerability scan of your internet-facing IP addresses.
- Internal scans of sampled devices, checking high and critical updates were applied within 14 days.
- Malware protection, including whether test files sent by email or downloaded in a browser are blocked.
- MFA on in-scope cloud services.
- That users do not work day to day with admin rights.
How sampling works
The assessor picks a representative sample of devices. Since April 2026, if issues are found and fixed, a second sample of the same size is tested. Repeat issues in the second sample fail the assessment, so fixes must cover the whole estate, not just the devices that were checked.
The usual reasons for failing
- Third-party apps such as browsers, PDF readers, Java and meeting apps with missing updates.
- Devices that have dropped out of the patching tool.
- Users with local admin rights.
- Cloud services without MFA.
- Old operating system builds or unsupported software still in scope.
Preparation checklist
- Confirm the scope and device list, and check it against your RMM inventory.
- Run an authenticated vulnerability scan across every in-scope device.
- Patch high and critical issues, third-party apps included, and remove unsupported software.
- Check email and browser protection blocks malicious attachments and downloads.
- Confirm MFA everywhere and separate admin accounts from everyday ones.
- Agree test dates and tell users if they need to be available.
Work backwards from the date you need the certificate, whether that is a tender deadline or an insurance renewal. Late starts cause most of the stress.