Source: https://cloud365.io/blog/cyber-essentials-plus-preparation-checklist/ # Cyber Essentials Plus: How to Prepare for Your Assessment 4 November 2026 3 minute read By the cloud365.io team Updated 4 November 2026 Prepare for Cyber Essentials Plus by agreeing the assessment scope, checking your systems and arranging the right people and access. The independent assessor tests whether the required controls work in practice. A tidy questionnaire alone is not enough. On this page ## Agree the route before booking Plus builds on Cyber Essentials with a technical assessment. Read [IASME’s certification process](https://ce-knowledge-hub.iasme.co.uk/space/CEKH/4412801084) and confirm your existing certificate, scope and dates with the certification body. [IASME’s FAQ](https://iasme.co.uk/cyber-essentials/frequently-asked-questions) explains the three-month relationship between the verified self-assessment and Plus certification. Ask about this before choosing assessment dates, particularly when you already hold Cyber Essentials. For the choice between the two certificates, use our [CE-versus-Plus guide](https://cloud365.io/blog/cyber-essentials-plus-who-needs-it/). ## Prepare a clear handover Make one person responsible for coordinating the assessment. Give them a short action list and access to the people who manage the relevant systems. | Preparation item | What to have ready | | --- | --- | | Scope | Agreed organisation, locations, systems and certificate details | | Inventory | Current device and software records, with an owner for missing information | | People | Contacts who can explain the setup and arrange authorised access | | Availability | Agreed times when the chosen devices and users will be available | | Outstanding work | A list of fixes, owners and completion checks | The assessor decides the required sample and testing arrangements. Do not assume that providing one convenient laptop covers the whole organisation. ## Check the controls in practice IASME’s preparation guidance describes checks involving updates, malware protection, administrator privileges and MFA, alongside vulnerability testing. Work through those areas with your IT provider before the assessment. Our practical advice is to verify each change rather than closing a task because someone clicked “install” or “enable”. A device may need restarting, a policy may not have reached every user, or an exception may still exist. Record what was checked and what remains uncertain. Do not create broad security exceptions simply to make testing easier. Agree any specific access or test requirements with the assessor and your system owner, including how temporary access will be removed afterwards. ## Plan for disruption and follow-up Tell staff what is happening, who is coordinating it and where to report unexpected problems. Pick a time that gives your team room to respond if something needs attention. If a gap is identified, ask what must be corrected, what evidence is required and whether retesting changes the schedule or price. Certification depends on the assessment result; preparation support cannot guarantee a pass. An illustrative example: a small practice might have an updated office laptop but a rarely used remote laptop still waiting for work. Finding that before assessment gives the practice a clear task. It does not justify excluding the device without an agreed scope decision. ## Compare the work included in a quote Ask whether the quote includes Cyber Essentials, preparation, independent Plus testing and any remediation. Check how additional work or retesting is handled. See our [cost guide](https://cloud365.io/blog/cyber-essentials-cost/) for the difference between assessment and supported packages. To scope help, we need your team size, current certificate status and any customer deadline. Technical access is arranged separately after the work is agreed; do not send passwords through the enquiry form. [Ask about Plus preparation](https://cloud365.io/start/?service=ce&ce_level=ce_plus), or review our [Cyber Essentials Plus service](https://cloud365.io/cyber-essentials-plus/). ## Common questions Does preparation support guarantee a pass? No. The independent certification body makes the certification decision after assessing the controls. What should I send with an initial enquiry? Your team size, whether you already hold Cyber Essentials, the certificate date and any customer deadline. Do not include passwords or sensitive system details. ## More guides [4 November 2026 3 minute read ### Cyber Essentials Renewal: When to Start and What to Check Plan your Cyber Essentials renewal with a practical checklist for certificates, devices, cloud services and changes since last year. Know what to prepare. Read the guide](https://cloud365.io/blog/cyber-essentials-renewal-checklist/)[4 November 2026 3 minute read ### Cyber Essentials: Staff Phones and Personal Laptops Find out what to check when staff use personal phones or laptops for work. A practical Cyber Essentials guide to device scope, responsibilities and next steps. Read the guide](https://cloud365.io/blog/cyber-essentials-personal-devices/)[22 October 2026 4 minute read ### Cyber Essentials Cost: Assessment or Supported Package? Compare Cyber Essentials assessment fees with supported packages. See what Cloud365 includes, what fixes cost extra and how to budget for Plus and renewal. Read the guide](https://cloud365.io/blog/cyber-essentials-cost/)