Cyber Essentials Plus Checklist and Requirements
Cyber Essentials requirements: what’s covered in the Plus audit?
Each control is tested during the audit to confirm it has been implemented correctly.
Requirements:
- Change default admin passwords to a strong, unique password or disable remote admin access entirely
- Block unauthenticated inbound connections by default
- Prevent remote admin access from the internet unless there is a documented business need and it is protected by MFA (multifactor authentication) or an IP allow list combined with properly managed password authentication
- Document and approve all inbound rules, with business justification
- Remove or disable firewall rules when they are no longer needed
- Use host-based firewalls on devices used on public or untrusted networks
Requirements:
- Remove/disable unnecessary user accounts and software
- Change default or guessable passwords
- Disable auto-run features that execute files without permission
- Authenticate all users before granting access to data or systems
- Use device locking controls for physically present users
Requirements:
- Have a clear account creation and approval process
- Authenticate users with unique credentials
- Remove accounts that are no longer needed
- Implement MFA where available (mandatory for Cloud services)
- Restrict administrative accounts to admin activities only
- Remove special access privileges when not needed
- Anti-malware software (for devices running Windows or macOS)
- Application allow whitelisting (for all devices)
If using anti-malware software:
- Keep it updated in line with vendor recommendations
- Prevent malware from running
- Prevent the execution of malicious code
- Prevent connections to malicious websites over the Internet
If using application allow whitelisting:
- Actively approve applications before deploying them to devices
- Maintain a current list of approved applications
- Stop users installing any applications that is unsigned or has an invalid signature
Requirements:
- Use only licensed and supported software
- Remove unsupported software
- Enable automatic updates wherever possible
- Apply patches within 14 days of release where they fix:
- Vulnerabilities the vendor rates critical or high risk
- Vulnerabilities with a CVSS (Common Vulnerability Scoring System) v3 base score of 7 or above
- Vulnerabilities of unknown severity (where the vendor gives no details)
Cyber Essentials Plus FAQ
Cyber Essentials Plus is a government-backed certification scheme that helps organisations implement a strong baseline of cyber security. It requires organisations to undergo greater scrutiny of their IT infrastructure.
The ‘Plus’ version of the scheme contains the same five technical controls as in ‘Cyber Essentials‘ to help prevent most common cyber attacks. The main difference is that these controls must be reviewed by an independent auditor to verify that they work as intended.
As such, Cyber Essentials Plus offers even greater reassurance to stakeholders that certified organisations are committed to effective security.
To certify to Cyber Essentials Plus, you must first hold a valid Cyber Essentials certificate. You must then select an accredited certification body and then undergo a technical audit of these systems.
The test must be performed by an independent assessor, who will perform tests, such as vulnerability scans, to ensure that your organisation’s technical controls are robust.
If the auditor spots any significant problems, they will inform your organisation and give you the opportunity to address them. Once they are satisfied that your controls meet the scheme’s standards, you will receive the Cyber Essentials Plus certificate.
Your organisation needs Cyber Essentials Plus if it is required by a partner in your supply chain. For example, many UK government contracts specify that organisations must be certified to win certain contracts – especially those involving sensitive information.
Cyber Essentials Plus certification demonstrates that your organisation has implemented robust defences to prevent common cyber threats. While you can use a self-assessment to certify to Cyber Essentials, the ‘Plus’ version of the scheme requires you to undergo a third-party audit.
This can be invaluable to stakeholders, as it proves that your report is accurate and that your technical controls work as intended. This can enhance your reputation and give you a competitive advantage when bidding for contracts.
Yes, you are only eligible for Cyber Essentials Plus if you are already certified under the basic level of the scheme.
This is because the controls you implement are the same for Cyber Essentials and Cyber Essentials Plus. The main difference between the two certificates is that Cyber Essentials Plus comes with an extra layer of scrutiny. To certify, an independent expert will test your systems to make sure the information you gave in your Cyber Essentials self-assessment is correct and that controls work as described.