Need Cyber Essentials Plus? Here's what the audit involves

A customer or contract has asked for Cyber Essentials Plus, not just Cyber Essentials. That usually means they want independent proof that your security controls work, not just your word that they are in place.

Cyber Essentials Plus uses the same five controls as Cyber Essentials, but an assessor tests a sample of your systems to check them. You need a Cyber Essentials certificate that is less than three months old before the audit. Cool Waters Cyber is an IASME Certification Body, so we can certify your Cyber Essentials and carry out your Cyber Essentials Plus audit, one straight after the other if you need both.

Who needs Cyber Essentials Plus?

You are likely to need it if:

• A customer, prime contractor or public sector buyer has asked for it by name
• You are working towards Defence Cyber Certification (DCC) Level 2 or 3, which require Cyber Essentials Plus
• You handle sensitive data or work in a supply chain where a higher level of assurance is expected
• You want proof that your IT team or IT provider has set up the Cyber Essentials controls correctly

What does the audit involve?

The audit checks that a sample of your systems meets the Cyber Essentials controls. You pass Cyber Essentials Plus by passing each of these tests:

1. External vulnerability scan. We scan your internet-facing services for weaknesses an attacker on the internet could use to break in.
2. Internal update check. We check a random sample of your computers and servers to confirm critical security updates have been installed within 14 days, as Cyber Essentials requires.
3. Malware protection review. We check your anti-malware is working and actively protecting your devices.
4. Email malware test. We send safe but suspicious test emails to some of your staff to prove your email protection catches them.
5. Web malware test. We check whether your users can download safe but suspicious test files, provided by the scheme, from the internet.
6. Account checks. We check that your admin accounts and logins are properly protected.

None of the test files or emails can harm your systems. They are designed to look dangerous so we can see whether your defences react.

Why the audit catches people out

The current Cyber Essentials Plus rules are strict: a single high-risk weakness on one of the computers the assessor tests can be enough to fail. The NCSC (the National Cyber Security Centre) requires assessors to use enterprise-grade vulnerability scanners, and they often find problems that ordinary Windows, Mac and application updates don’t fix, such as old versions of software left behind after an upgrade.

Our Enhanced Compliance service

To take that risk out of the audit, our Enhanced Compliance service scans every computer in your organisation to the Cyber Essentials Plus standard a month before your audit. That gives your IT team or IT provider plenty of time to find and fix anything the scan turns up.

During the formal audit the assessor still picks a random sample of computers to test, but you can be confident they will already be compliant.

For Managed Cyber Team clients, we run the same full scan across your whole organisation every month, so you are genuinely compliant all year round, not just in the week of the audit.

How to prepare

The best preparation is a Cyber Essentials submission that truly reflects how your systems are set up. Before the audit, check that every device in scope is up to date, that anti-malware is running everywhere, and that admin accounts are separate from everyday ones. If your IT is run by someone else, involve them early, as the audit is a direct test of their work.

If anything fails, we explain what failed, why it matters and what needs to change.

What we do, and what we don’t

We plan the audit with you, run the tests and explain the results in plain English. If you would rather we ran your IT to this standard all year round, see secure IT support.

We won’t pass something that doesn’t work. Your customers rely on the certificate meaning what it says, and so do you.

Want to go further?

If your customers want to see governance, risk management and data protection as well as technical controls, look at IASME Cyber Assurance. For a deeper technical test of your systems, see security testing.

Talk to us about Cyber Essentials Plus