The three-month window for Cyber Essentials Plus

You must complete the Cyber Essentials Plus audit within three months of passing Cyber Essentials. IASME treats this as 90 days from the Cyber Essentials verified self-assessment, and it cannot be extended. The audit must cover exactly the same scope as that Cyber Essentials certificate. Everything in the Plus process, including fixing anything the first round of testing finds, has to fit inside those 90 days.

Why the window exists

Plus is a technical check that the answers in your self-assessment are still true. The closer the audit is to the self-assessment, the more meaningful that check is. A gap of many months would let systems drift away from what was declared.

What has to fit inside the 90 days

1. Book the audit. Find a Certification Body and agree dates. Ideally do this before you submit Cyber Essentials, so the clock is not running while you shop around.
2. Scope check. Before testing, the assessor confirms the Plus scope matches the Cyber Essentials certificate, and checks by technical means that any excluded sub-set is properly segregated.
3. Sample 1 testing. The assessor tests a first sample of devices, servers and cloud accounts. You get notice before each sample is tested: IASME sets this at 72 hours, or 3 working days.
4. Remediation, if needed. Under Danzell, if Sample 1 finds missing critical or high-risk updates, you have a 30-day window to fix them. The fix must be applied across every in-scope device, not only the devices that were sampled.
5. Sample 2 testing. A second sample checks that the fixes were applied across the scope. There is no further remediation window after Sample 2.

If the second sample shows the same vulnerabilities as the first, you fail Plus and the underlying Cyber Essentials certificate is revoked as well.

Before the clock starts

Under Danzell, every non-conformity in the Cyber Essentials self-assessment must be resolved before Plus testing begins, and you cannot change your self-assessment answers based on what the audit finds. That means the work to be ready for Plus is best done before you submit Cyber Essentials, not after.

A sensible timeline

• Before submitting Cyber Essentials: book the Plus audit, run your own authenticated vulnerability scan, and fix what it finds.
• Weeks 1 to 4 after the certificate: Sample 1 testing.
• Up to 30 days after Sample 1: remediation across the whole scope, if needed.
• After remediation: Sample 2 testing, leaving time inside the 90 days.

This is an illustration, not a scheme rule. Agree real dates with your Certification Body.

If testing cannot finish on the day

The NCSC test specification allows tests to be deferred where there are genuine technical difficulties, at the Delivery Partner's discretion. Deferral does not extend the 90-day window, so leave margin.

If you miss the window

If the audit is not completed within 90 days, you cannot take Plus on that Cyber Essentials certificate. Your Cyber Essentials certificate itself is unaffected unless it was revoked after a failed second sample. To get Plus you would normally need a new Cyber Essentials assessment and then a Plus audit within three months of it. Ask your Certification Body how they handle this before it happens.

Renewals work the same way

Each year you renew Cyber Essentials first, then complete Plus within three months of the new certificate. If your Plus certificate needs to stay current for a contract, plan the Cyber Essentials renewal date with the Plus audit in mind. See Certificate validity and renewal.

Checklist

• Plus audit booked before Cyber Essentials is submitted
• All self-assessment answers true and every gap fixed
• Your own scan run, with critical and high findings fixed
• Users and devices available for each sampling date
• Time left for remediation and Sample 2

See also Preparing for Cyber Essentials Plus and What Cyber Essentials Plus tests.

To plan dates and get a price for Plus, request a quote.