Preparing for Cyber Essentials Plus

The best preparation for Cyber Essentials Plus happens before you submit your Cyber Essentials self-assessment. Under Danzell, every gap in the self-assessment must be fixed before Plus testing starts, you cannot change your answers based on what the audit finds, and the whole audit must finish within 90 days of the Cyber Essentials certificate. So make every answer true across the whole estate, check your own patching with an authenticated scan, and book the audit early.

1. Plan the timing

• Book your Plus audit before you submit Cyber Essentials, so the 90-day window is not spent finding an assessor.
• Leave room for a 30-day remediation period and a second sample in case the first sample finds missing updates.
• Expect 72 hours' notice before each sample is tested, and make sure the right people will be available.

See The three-month window for Plus.

2. Confirm the scope

The Plus scope must match your Cyber Essentials certificate exactly, and the assessor checks this by technical means.

• Keep an up-to-date list of every device by type, operating system edition and version. Each version is sampled separately.
• List your external IP addresses and DNS names, including cloud servers.
• If you use a sub-set, check the segregation really works. A firewall or VLAN is needed; user groups or per-device rules do not count.
• Include phones, tablets and personal devices that reach work data.

3. Patch everything, then check

Missing updates are where Plus is most demanding. The assessor runs an authenticated scan on sampled devices and fails any critical or high-risk vulnerability whose fix has been out for more than 14 days.

• Run your own authenticated vulnerability scan across all devices, not just a few.
• Fix operating systems, firmware, browsers, browser extensions, runtimes such as Java and .NET, PDF readers and other third-party apps.
• Remove software you do not need. Every application installed is one more thing to patch.
• Remove or isolate unsupported software and operating systems. Virtual patching will not be accepted for them.
• Check devices that are often switched off, such as spare laptops, and bring them up to date.

See The 14-day update rule.

4. Check malware protection

• Confirm anti-malware is installed, running and updating on every Windows, macOS and Linux device and every server with a desktop. On Linux, ClamAV with on-demand scanning is accepted.
• Check your email filtering blocks malware attachments and that executables do not run without a warning.
• Check web protection blocks malicious downloads in each browser you use.
• If you use application allow listing, check unsigned apps really cannot run.
• Expect the assessor's test website and email to need allowing through your filtering so the tests can reach users. Ask your Certification Body what is required.

5. Check MFA on every cloud service

The assessor watches a normal user and an admin sign in to each cloud service from a private browser window or untrusted device.

• Make sure every user and admin account is prompted for MFA, with no exceptions for trusted locations.
• Check older sign-in methods that might bypass MFA.
• Include smaller services, not just Microsoft 365 or Google Workspace.

See MFA for cloud services.

6. Check admin separation

On sampled devices, a standard user will try to run an admin task. It must ask for separate admin credentials and not run under their own account.

• Remove local admin rights from everyday accounts.
• Make sure admins use a separate admin account only for admin work.

See User access control.

7. Check your firewalls

• Close any internet-facing ports and services you do not need.
• Make sure admin interfaces are not reachable from the internet unless documented and protected by MFA or an IP allow list.
• Update firewall and router firmware.

8. Get people and devices ready

• Line up users who can join the session for each sampled device, with working email and a browser.
• Have an admin available for each cloud service test.
• Agree how remote sessions will work if testing is remote.
• Give the assessor written permission to test.

Pre-audit checklist

• Self-assessment answers true across the whole scope
• Own authenticated scan run, critical and high findings fixed
• No unsupported software in scope
• Malware protection active and updating everywhere
• MFA prompted for every user and admin on every cloud service
• No everyday accounts with admin rights
• Plus audit booked, with time left for remediation

To price your Plus audit, request a quote.