Cyber Essentials Plus Preparation

What Cyber Essentials Plus adds

Cyber Essentials is a verified self-assessment: you answer questions and a director signs to say they are true. Cyber Essentials Plus uses exactly the same controls, but an assessor checks them on your actual systems. IASME's FAQ describes the audit as including an internal and external vulnerability scan, then testing a representative sample of user devices (typically around 10 per cent), all internet gateways and all servers with services accessible to unauthenticated internet users. The assessor then decides whether further testing is needed.

You must already hold the basic certificate. IASME says that if you achieved the self-assessment certificate less than 3 months before the Plus audit, you do not need to repeat the questionnaire. Leave it longer and you start again.

dijitul does not carry out Cyber Essentials Plus audits and is not a certification body. We prepare your systems so the assessor finds what your self-assessment said they would.

What the audit typically tests

• Patching: the vulnerability scans look for missing high and critical updates older than 14 days, on operating systems, browsers and apps such as Adobe Reader, Zoom or Java.
• Malware protection: assessors use harmless test files to check that email and web downloads are blocked or caught on sampled devices.
• MFA: they check that cloud services such as Microsoft 365 prompt for a second factor.
• Account separation: day-to-day users should not be running as administrators.
• Firewall and gateways: the external scan checks your public IP addresses for open services that should not be exposed.
• Mobile devices: sampled phones must have supported operating systems, screen locks and current updates.

Because the sample is random, every in-scope device has to be ready, not just the ones you expect to be picked.

How we prepare you

1. Inventory: confirm every device, server, gateway and cloud service in scope, and that it matches your self-assessment.
2. Our own scans first: authenticated vulnerability scans of your devices and an external scan of your public IPs, so you see what the assessor will see.
3. Patch and harden: clear missing updates, remove unsupported software, close unneeded ports and tighten admin rights. Intune update rings help keep it that way; see Intune device management.
4. Test malware protection on every device type, including Macs, which are often missed. See endpoint protection.
5. Check MFA on every cloud account, including admin and service accounts.
6. Audit day support: we can be available remotely while the assessor works, to fix anything quickly.

Common reasons for failing the Plus audit

• One forgotten laptop. A device that has been in a drawer for three months, missing every update, gets picked in the sample.
• Third-party apps out of date. Windows is patched but an old version of a PDF reader, Java or a browser extension is not.
• Admin by default. Staff logging in every day with local administrator rights.
• MFA gaps. A rarely used cloud service, such as an old accounting or HR system, without MFA switched on.
• Macs and phones overlooked. Malware protection and updates checked on Windows only.
• Scope mismatch. The self-assessment described a smaller setup than the assessor finds.

Every one of these is avoidable with a pre-audit check, which is what we do.

Cost

The Plus audit is quoted individually by certification bodies because it depends on the size and complexity of your network. IASME's FAQ gives a rough estimate of around £1,400 for a small, simple company and offers a form that returns quotes from three certification bodies. That fee goes to the certification body.

Our preparation is quoted upfront after we have seen your estate, because a tidy ten-laptop office on Business Premium needs far less work than a mixed estate with on-site servers. Small fixes found later are £45 an hour + VAT. If you do not yet hold the basic level, start with Cyber Essentials certification.

Related