What is Cyber Essentials Plus?

Cyber Essentials Plus is the audited tier of the UK Cyber Essentials scheme, owned by the NCSC and delivered by IASME. The requirements are the same five control themes — firewalls, secure configuration, security update management, user access control and malware protection. What changes is how they are evidenced.

What Plus adds

Under Cyber Essentials, the organisation answers a self-assessment questionnaire and a certification body reviews the answers. Under Plus, an assessor from a certification body carries out technical testing to confirm the controls really are in place. That work typically includes vulnerability scanning of internet-facing systems, scanning of a sample of in-scope end-user devices and servers, and checks on patch levels, malware protection and account configuration on that sample.

Plus builds on a passing self-assessment rather than replacing it: the audit must follow a current Cyber Essentials certification and be completed within three months of it.

Why the external half is worth fixing first

The internet-facing part of a Plus assessment is essentially an external vulnerability scan, and it is the part you can rehearse. Unpatched services carrying known CVEs, exposed admin panels, default credentials and services that should never have been reachable at all are all findable in advance with port scanning and service fingerprinting.

Scope is the other common surprise. An assessor tests what is in scope, and organisations routinely under-declare — a forgotten staging host, a marketing subdomain, a VPN gateway nobody owns any more. Running asset discovery before the assessment turns those into decisions rather than findings.

Related concepts

Plus is a point-in-time audit, so the posture it verifies drifts as soon as it finishes — which is the argument for continuous threat exposure management between renewals. Compare with ISO 27001 and SOC 2, which assess management systems and control operation rather than a fixed technical baseline.