Cyber Essentials Plus adds a technical audit to the Cyber Essentials verified self-assessment, using the same five technical controls.[1] Prepare by agreeing the scope with your certification body, checking the equipment and arranging access for testing. Ask for the audit requirements before booking staff time or promising a completion date to a customer.
Start with a practical readiness review rather than another policy document. Name someone to coordinate the work, collect the device information and keep unresolved questions together. Keep certification fees separate from any technical preparation you commission. This guide covers getting ready for the audit itself; our preparation-cost guide covers the budget decisions.
Agree what the assessor will test
IASME says the audit can be remote or on site and includes external vulnerability scanning of each public IP address in scope.[1] Ask your certification body to confirm the addresses and services it expects to test. Have your IT provider check that list against the business’s actual internet connections before approving it.
Describe remote working, additional offices and outsourced systems when discussing scope. Do not quietly omit an awkward device or assume a supplier-managed service is somebody else’s concern. Ask the assessor to resolve uncertain cases in writing. Keep that agreed scope beside your equipment record so everyone prepares for the same assessment.
Make the device sample available
Testing covers a representative sample of devices, including each operating system in use.[1] Prepare an inventory that identifies device type, operating system, owner and location. Include the equipment people actually work on, then ask the certification body how it will select its sample. Do not choose only the newest laptops yourself.
Arrange for relevant staff and equipment to be available during the agreed window. If somebody works away from the office, agree how their device will be reached and who will help with access. Flag absences early. Ask what to do if a selected device is replaced, breaks or cannot connect before the appointment.
Check updates before the appointment
IASME’s audit guide includes checks that software is supported and updated, with high and critical vulnerability fixes applied within 14 days.[1] Ask your administrator to review the actual devices and applications against the current requirements. Request a record of unresolved issues rather than accepting a general assurance that updates are automatic.
Give each outstanding change an owner and a maintenance window. Check whether a restart or application test is still needed after installation. Where an upgrade could interrupt business software, arrange the testing beforehand with its supplier. Ask the assessor how any unresolved finding affects readiness instead of hoping it will fall outside the sample.
Test access using ordinary accounts
The audit checks that standard users cannot perform administrator tasks and that multi-factor authentication protects access to cloud services in scope.[1] Ask your IT provider to review those controls using normal working accounts, not just an administrator’s demonstration. Have the assessor explain what access it needs before the session starts.
Agree how temporary audit access will be authorised, recorded and removed afterwards. Keep passwords and recovery codes out of the planning spreadsheet. Give staff a named contact for unexpected access requests, and ask the certification body to confirm its communication arrangements. Avoid making last-minute account changes without understanding who or what depends on them.
Leave time to fix findings
IASME says the Plus audit must be completed within three months of the most recent Cyber Essentials certification, and every required test must pass.[1] Discuss dates with the certification body before making a commitment to a customer. Include time for preparation and possible follow-up, rather than treating the appointment as a guaranteed certificate date.
Ask how findings will be explained, who will verify remedial work and whether further testing carries a charge. Request a written action record after any unsuccessful check. Have your technical team confirm what it changed and what remains open. Keep the assessment outcome separate from an internal claim that a fix has been installed.
Bring a readiness brief to the conversation
Prepare a short brief with your agreed scope, device inventory, proposed dates and unresolved technical questions. Send it to the certification body and whoever manages your IT. Ask each to identify the information it still needs and the work it owns. Confirm responsibilities before paying for overlapping preparation services.
If you need help checking the technical setup, talk to BMT about your small-business cyber security arrangements. Bring the brief and the assessor’s requirements, not a promise that everything already passes. Agree the preparation work separately from the independent assessment, then book the audit when the certification body and your technical team have reviewed readiness.