Cyber Essentials Plus Preparation Support
Ready for the Hands-On Audit
Cyber Essentials Plus adds a hands-on technical audit to the Cyber Essentials requirements. Pulsar IT helps you prepare your devices, accounts and cloud services for the checks the assessor will carry out, and can help fix issues within the audit window.
What is Cyber Essentials Plus Preparation Support?
Cyber Essentials Plus uses the same requirements as Cyber Essentials, covering the same five control areas: firewalls, secure configuration, security update management, user access control and malware protection. The difference is that, instead of relying only on your questionnaire answers, an assessor from an IASME-licensed certification body checks your systems in a hands-on technical audit. It must be completed within three months of your Cyber Essentials certification.
Because the assessor tests real devices and accounts, settings that look right on paper can still fail in practice: a laptop that missed an update, a browser that lets a test file through, or a cloud service where one account has no multi-factor authentication (MFA). Our preparation support looks for these problems before the assessor does.
Pulsar IT does not carry out the audit or issue the certificate. We help you prepare, fix what we find and, where agreed, support you through the audit.
Key benefits
- Pre-audit checks focused on what the assessor will test
- Patching, malware protection and MFA confirmed on real devices and accounts
- Every operating system in scope prepared, not just the obvious ones
- Help fixing issues quickly if the audit finds any
- A plan that fits the three-month deadline after Cyber Essentials
How does it work?
Cyber Essentials Plus builds on a Cyber Essentials certificate. We start from your self-assessment and scope, then check the same areas the audit will examine, so issues are fixed on your timetable rather than during the audit.
Confirm scope and timing
We review your Cyber Essentials certificate and scope, check the three-month deadline, and help you prepare the written permission and scope information the certification body needs before the audit.
Pre-audit technical checks
We check a representative sample of devices across every operating system in scope for updates, malware protection and admin account separation, confirm MFA on your cloud services, and review your internet-facing systems with your authorisation.
Remediate
We fix the gaps we find within the agreed scope, such as missing updates, misconfigured protection or accounts without MFA, then recheck them.
Audit and follow-up
The certification body's assessor carries out the audit. If issues are found, there is a limited window of 30 days to fix them, and we can help you close them within that time.
- Cyber Essentials certificatePlus must follow within three months
- Pre-audit checksSample devices, cloud accounts and public IPs
- RemediationGaps fixed and rechecked
- Assessor's auditHands-on checks by the certification body
Pre-audit preparation covers
- Update status of Windows, macOS and other devices in scope, including browsers and commonly used applications
- Malware protection settings, and how email and web downloads are handled
- Separation of admin accounts from everyday accounts on devices and in cloud services
- MFA enforcement across every in-scope cloud service, including Microsoft 365
- Services exposed on your public IP addresses
- Firewall and router firmware currency
- Removal or replacement of unsupported operating systems and software
What the Cyber Essentials Plus audit checks
The assessor works from the same five control areas as Cyber Essentials, but tests them directly. The certification body sets the exact test plan; these are the main areas to prepare for.
External scan
A scan of each public IP address in scope, looking for exposed services and known vulnerabilities on your internet-facing systems.
Sample of devices
A representative sample of user devices, covering every operating system in scope, is checked by the assessor.
Patching
Checks that critical and high-risk security updates on the sampled devices were installed within 14 days of release.
Malware tests
Harmless test files are delivered by email and through the web browser, to confirm that malware protection deals with them.
Account separation
Checks that administrator accounts are kept separate from the accounts people use for email and browsing.
MFA on cloud services
Checks that multi-factor authentication is in place on the cloud services in scope.
Before the audit, the certification body needs your written permission and will verify your scope. The bar is higher than for Cyber Essentials, so plan early to keep within the three-month deadline.
Problems solved
Settings that pass on paper but fail in practice
Pre-audit checks test the real state of devices and accounts, not just the policies.
A three-month deadline after Cyber Essentials
We plan preparation around the deadline, so there is time to fix larger issues before the audit.
One forgotten device type or account
The assessor's sample covers every operating system in scope. We help bring every in-scope device to the same standard, not only the ones you expect to be checked.
Limited time to fix audit findings
With 30 days to resolve issues, it helps to have a team ready to make fixes and provide evidence.
A customer requires the higher level
Some contracts ask for Cyber Essentials Plus because it gives independent, hands-on evidence. We help you get ready for it.
What's included
Included as standard
- Review of your Cyber Essentials scope and the deadline for the audit
- Help preparing written permission and scope information for the certification body
- Pre-audit checks on a sample of devices across every operating system in scope
- Checks of patching, malware protection, admin separation and cloud MFA
- Review of internet-facing services on your public IP addresses, with your written authorisation
- Remediation of agreed gaps before the audit, within the quoted scope
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Support during the audit, where agreed with you and the certification body
- Fixing issues raised by the assessor within the 30-day window
- Upgrading or replacing devices that cannot meet the requirements
- Managed Endpoint Security to keep patching current between renewals
What's not included
- The audit and the certificate, which are carried out and issued by an IASME-licensed certification body
- Certification body audit and assessment fees
- Preparation for the Cyber Essentials self-assessment, covered by Cyber Essentials Readiness
- Hardware, licences and replacement devices
Pulsar IT helps you prepare but does not audit or certify. The assessor chooses the test sample and decides the outcome, so pre-audit checks reduce the risk of failure rather than remove it.
Cyber Essentials Plus must be completed within three months of your Cyber Essentials certification. If preparation starts late, there may not be enough time for larger fixes such as replacing unsupported devices.
Who it's suitable for
- Organisations whose contracts or customers require Cyber Essentials Plus
- Businesses that hold, or are about to gain, Cyber Essentials
- Organisations with a mix of Windows, macOS and mobile devices
- Businesses that want hands-on evidence their controls work
Pricing
We quote preparation support after reviewing your scope and your Cyber Essentials results. The audit is carried out and charged for separately by the certification body.
Use the quote builder to add Cyber Essentials Plus Preparation Support to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Number of devices and operating systems in scope
- Number of public IP addresses
- Number of cloud services
- Findings from your Cyber Essentials self-assessment
- Remediation needed before or during the audit
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Do we need Cyber Essentials first?
Yes. Cyber Essentials Plus is completed after Cyber Essentials, within three months of your Cyber Essentials certification. If you don't hold Cyber Essentials yet, start with Cyber Essentials Readiness.
What does Plus add to Cyber Essentials?
The requirements are the same. Cyber Essentials relies on your self-assessment answers; Cyber Essentials Plus adds a hands-on technical audit by an assessor, including an external scan and checks on a sample of devices, so it gives stronger evidence that the controls are working.
Which devices will the assessor check?
A representative sample covering every operating system in scope. Because of that, the safest approach is to prepare every in-scope device to the same standard rather than only the ones you expect to be picked.
What are the malware tests?
The assessor uses harmless test files, delivered by email and through a web browser, to check how your malware protection handles them. We review your email filtering and malware protection settings beforehand so you know how they are likely to respond.
What happens if the audit finds a problem?
There is a limited window of 30 days to fix the issues and show the assessor they are resolved. Preparing beforehand means fewer issues to fix in that window, and we can help with the remediation where agreed.
Why does the certification body need written permission?
The audit includes scanning your public IP addresses and testing your devices, which needs your authorisation. The certification body also verifies your scope before testing, so it helps to gather this information early.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.