Cyber Essentials Plus: How to Prepare for Your Assessment

Agree the route before booking

Plus builds on Cyber Essentials with a technical assessment. Read IASME’s certification process and confirm your existing certificate, scope and dates with the certification body.

IASME’s FAQ explains the three-month relationship between the verified self-assessment and Plus certification. Ask about this before choosing assessment dates, particularly when you already hold Cyber Essentials.

For the choice between the two certificates, use our CE-versus-Plus guide.

Prepare a clear handover

Make one person responsible for coordinating the assessment. Give them a short action list and access to the people who manage the relevant systems.

The assessor decides the required sample and testing arrangements. Do not assume that providing one convenient laptop covers the whole organisation.

Check the controls in practice

IASME’s preparation guidance describes checks involving updates, malware protection, administrator privileges and MFA, alongside vulnerability testing. Work through those areas with your IT provider before the assessment.

Our practical advice is to verify each change rather than closing a task because someone clicked “install” or “enable”. A device may need restarting, a policy may not have reached every user, or an exception may still exist. Record what was checked and what remains uncertain.

Do not create broad security exceptions simply to make testing easier. Agree any specific access or test requirements with the assessor and your system owner, including how temporary access will be removed afterwards.

Plan for disruption and follow-up

Tell staff what is happening, who is coordinating it and where to report unexpected problems. Pick a time that gives your team room to respond if something needs attention.

If a gap is identified, ask what must be corrected, what evidence is required and whether retesting changes the schedule or price. Certification depends on the assessment result; preparation support cannot guarantee a pass.

An illustrative example: a small practice might have an updated office laptop but a rarely used remote laptop still waiting for work. Finding that before assessment gives the practice a clear task. It does not justify excluding the device without an agreed scope decision.

Compare the work included in a quote

Ask whether the quote includes Cyber Essentials, preparation, independent Plus testing and any remediation. Check how additional work or retesting is handled. See our cost guide for the difference between assessment and supported packages.

To scope help, we need your team size, current certificate status and any customer deadline. Technical access is arranged separately after the work is agreed; do not send passwords through the enquiry form.

Ask about Plus preparation, or review our Cyber Essentials Plus service.