Cyber Essentials Plus requirements — the checks your business must pass

Cyber Essentials Plus requires organisations to meet the Cyber Essentials scheme’s five technical controls and pass independent testing by an accredited assessor — it is administered under the NCSC-backed scheme and includes technical verification rather than just self-declaration, not a desk-only checklist. NCSC’s Cyber Essentials

1 — What the requirements actually cover

At its core, Cyber Essentials Plus checks that basic security controls are configured and working across your estate. The standard covers five technical control areas: boundary firewalls and internet gateways, secure configuration, user access controls, malware protection and patch management. Plus differs from the basic (self-assessment) level by requiring independent, hands-on verification — the assessor performs scans and may test endpoints to confirm the controls are effectively implemented.

For a UK business of 10–200 staff this typically means proving a few concrete things: that internet-facing services are behind a correctly configured firewall; that machines run supported, patched operating systems; that administrator accounts are limited and protected; and that anti-malware tools are active and up to date. The assessor will also check things you might assume are obvious — for example, that default accounts have been removed and that remote access uses multi-factor authentication where available.

This is about reducing common, low-effort attacks. The Plus process identifies where a control exists but is ineffective (such as a poorly configured firewall) and requires remediation before certification will be issued. That independent verification is the primary extra requirement compared with the Cyber Essentials self-assessment.

2 — Practical steps to meet the requirements

Most businesses pass Cyber Essentials Plus by taking a focused, technical checklist approach rather than a long project. The practical action points are straightforward:

Harden edge defences — ensure the perimeter firewall blocks unauthorised inbound services and that NAT and port-forwarding rules are minimal.
Maintain supported software — run only supported OS versions and apply security updates promptly; remove or isolate legacy kit where possible.
Enforce account hygiene — remove unused admin accounts, use unique, privileged accounts, and protect them with strong passwords and MFA.
Run and update anti-malware — ensure centrally managed endpoint protection is active and scans regularly.
Patch third-party apps — keep browsers, plugins and common business applications on supported releases.

For many firms these are changes a competent IT team or managed provider can complete in days. If you need a checklist to hand, your assessor will supply a scope document; you can also review Aurora’s Cyber Essentials overview for how evidence is typically presented to assessors. Strong documentation and basic network diagrams cut weeks off the process because the assessor can verify settings quickly.

3 — Timescales, cost considerations and business impact

Cyber Essentials Plus is primarily a technical test rather than a lengthy compliance programme. In practice, the timeline depends on how tidy your estate is: firms that already patch regularly and use managed endpoint protection often progress in a few weeks; those with unmanaged devices or poor inventory can take longer. Certification needs annual renewal, so plan for ongoing patching and monitoring rather than one-off fixes.

Cost varies by assessor and scope — expect the price to reflect the number of devices and any on-site work, but remember the most valuable returns are reduced breach risk and vendor trust when tendering for contracts. From a business-impact perspective, completing Plus demonstrates a verified level of baseline security that many public-sector and corporate procurement processes now ask for; failing to show independent verification can exclude you from some contracts.

Practical verdict: treat Cyber Essentials Plus as a short, technical project with a clear objective — evidence that the five controls are not only present but effective. Budget the assessor fee and the minor remediation work, then fold the evidence-gathering into routine IT tasks (patching cadence, access reviews) so renewal is low-friction.

When to ask for help: bring in outside expertise if you cannot quickly produce an accurate device inventory, lack centralised patch or endpoint management, or if remote access and admin accounts are unmanaged — those issues commonly block Plus assessment and are quicker to fix with an experienced provider. Getting help will save time and reduce the chance of failing the verification test, and frees your team to focus on business work rather than firefighting.

FAQ

What exactly does Cyber Essentials Plus test?

It tests the same five technical controls in the Cyber Essentials scheme but with independent technical verification by an accredited assessor rather than self-declaration.

How long does certification typically last?

Certificates are valid for 12 months and you must re-certify annually to keep the Plus status active.

Will Cyber Essentials Plus make me GDPR-compliant?

No — Plus verifies technical controls; GDPR compliance also requires documented policies, lawful processing bases and records of processing which are outside the scope of the technical test.

Do I need an on-site assessment for Plus?

Assessors usually perform remote scans and may request on-site checks depending on scope; if your environment has many offline or segmented systems an on-site visit is more likely.