Cyber Essentials Plus
What’s covered in the audit?
Create a secure boundary between your systems and external threats.
Requirements:
- Change default admin passwords or disable remote admin access
- Block unauthenticated inbound connections by default
- Prevent remote admin access from the internet unless protected by MFA or an IP whitelist
- Document and approve all inbound rules, with business justification
- Remove permissive rules when no longer needed
- Use host-based firewalls on devices used on public or untrusted networks
Requirements:
- Remove/disable unnecessary user accounts and software
- Change default or guessable passwords
- Disable auto-run features that execute files without permission
- Authenticate all users before granting access to data or systems
- Use device locking controls for physically present users
- In addition, physically present users must use appropriate device locking controls.
Requirements:
- Have a clear account creation and approval process
- Authenticate users with unique credentials
- Remove accounts that are no longer needed
- Implement MFA where available (mandatory for Cloud services)
- Restrict administrative accounts to admin activities only
- Remove special access privileges when not needed
- Anti-malware software
- Application whitelisting
- Sandboxing
If using anti-malware software:
- Keep definitions updated daily
- Auto-scan files on access (including downloads and network files)
- Scan web pages in browsers
- Block malicious websites unless you have documented, approved exceptions
If using application whitelisting:
- Maintain an approved application list
- Block installation of unsigned or invalid software
If using sandboxing:
- Isolate code of unknown origin
- Restrict access to sensitive resources (e.g. cameras, microphones, data stores, networks) unless explicitly allowed
Requirements:
- Use only licensed and supported software
- Remove unsupported software
- Enable automatic updates wherever possible
- Apply patches within 14 days for:
- Critical or high-risk vulnerabilities
- CVSS v3 score of 7.0+
- Any vulnerability with unknown severity
Choose the right level of support for your organisation
Cyber Essentials Plus FAQ
Cyber Essentials Plus is a government-backed certification scheme that helps organisations implement a strong baseline of cyber security. It is the advanced version of Cyber Essentials and requires organisations to undergo greater scrutiny of their IT infrastructure.
The advanced version of the scheme contains the same five technical controls that help prevent most common cyber attacks. The main difference is that these controls must be reviewed by an independent auditor to verify that they work as intended.
As such, Cyber Essentials Plus offers even greater reassurance to stakeholders that certified organisations are committed to effective security.
To certify to Cyber Essentials Plus, you must first hold a valid Cyber Essentials certificate. You must then select an accredited certification body, outline the parts of your organisation that are within scope and undergo a technical audit of these systems.
The test must be performed by an independent assessor, who will perform on-site tests, such as vulnerability scans, to ensure that your organisation’s technical controls are robust.
If the auditor spots any significant problems, they will inform your organisation and give you the opportunity to address them. Once they are satisfied that your controls meet the scheme’s standards, you will receive the Cyber Essentials Plus certificate.
Your organisation needs Cyber Essentials Plus if it is required by a partner in your supply chain. For example, many UK government contracts specify that organisations must be certified to win certain contracts – especially those involving sensitive information.
Cyber Essentials Plus certification demonstrates that your organisation has implemented robust defences to prevent common cyber threats. While you can use a self-assessment to certify to Cyber Essentials, the advanced version of the scheme requires you to undergo a third-party audit.
This can be invaluable to stakeholders, as it proves that your report is accurate and that your technical controls work as intended. This can enhance your reputation and give you a competitive advantage when bidding for contracts.
Yes, you are only eligible for Cyber Essentials Plus if you are already certified under the basic level of the scheme.
This is because the controls you implement are the same for Cyber Essentials and Cyber Essentials Plus. The main difference between the two certificates is that Cyber Essentials Plus comes with an extra layer of scrutiny. To certify, an independent expert will test your systems to make sure the information you gave in your Cyber Essentials self-assessment is correct and that controls work as described.
Cyber Essentials Plus. Let’s get to work.
IT Governance, a GRC Solutions company, is one of the founding Cyber Essentials certification bodies and remains one of the largest in the UK.
If you’re looking for guidance, practical advice or consultation, we can help.
✅ Fast, practical certification support
✅ Reduce cyber risk with essential controls
✅ Build trust and win more business