More and more buyers now ask suppliers for Cyber Essentials Plus before they sign. Public sector tenders, larger customers checking their supply chain and cyber insurers all use it as a quick way to see whether an organisation has the basics properly in place. If a bid or a renewal is coming up, it helps to know what the certification involves and where most organisations trip up.
What is Cyber Essentials Plus?
Cyber Essentials is the UK government-backed scheme, run by the National Cyber Security Centre and delivered by IASME, that sets out five technical controls every organisation should have. Basic Cyber Essentials is a self-assessment: you answer a question set and a director signs a declaration that the answers are true.
Cyber Essentials Plus covers the same five controls, but an independent assessor tests them on your actual systems. That hands-on audit is why buyers give it more weight. It shows the controls work in practice, not just on paper.
The five controls the audit checks
- Firewalls: internet connections and devices protected by properly configured firewalls.
- Secure configuration: default passwords changed, unnecessary software and accounts removed.
- Security update management: operating systems, firmware and applications kept supported and patched.
- User access control: the right people with the right access, and admin rights kept to a minimum.
- Malware protection: anti-malware or application controls in place on in-scope devices.
What changed in April 2026
IASME introduced the Danzell question set and version 3.3 of the requirements for accounts created after 26 April 2026. Two changes catch people out:
- Multi-factor authentication is now mandatory on every cloud service where it is available, including free and bundled services. Missing it is an automatic fail.
- Patching questions are now auto-fail. High-risk and critical updates must be installed within 14 days of release, for operating systems, router and firewall firmware, and applications.
For Plus, if the random sample of devices fails the update test, you fix the issues and the assessor retests the original sample plus a fresh one. A second failure means the certificate is revoked. IASME’s announcement has the full detail.
How the process works
You need basic Cyber Essentials first. IASME expects the Plus audit to be completed within three months of that certificate, so the two are best planned together. A typical route looks like this:
- Scope: agree which devices, users, cloud services and legal entities are in scope.
- Gap review: check every in-scope device and service against the five controls before anyone external looks.
- Remediation: fix what the review finds, usually patching, MFA, old devices and admin rights.
- Self-assessment: submit the question set for basic Cyber Essentials.
- Plus audit: the assessor runs vulnerability scans and tests a sample of devices and accounts.
Where organisations usually fail
In our experience the problems are rarely exotic. They are the things that drift when nobody owns them:
- A cloud service, often a free one, with no MFA switched on.
- Laptops or servers running an operating system that is out of support.
- Browsers, PDF readers or plug-ins weeks behind on updates.
- Staff working day to day with admin rights they do not need.
- Devices nobody knew were in scope, such as an old home router or a forgotten tablet.
Each of these is easy to fix once it is found. The cost comes from finding them during the audit rather than before it.
Already certified, starting from nothing, or not sure?
Most organisations we speak to fall into one of three groups.
Renewing or moving up to Plus. You already hold Cyber Essentials and need Plus for a contract, or your renewal is due under the new requirements. The priority is checking MFA and patching against the April 2026 rules before you resubmit.
Starting from nothing. A customer or tender has asked for it and you have no certification yet. A gap review first saves time and avoids a failed audit.
Not sure you need it. If you bid for public sector work, handle customer data for larger organisations or are reviewing your cyber insurance, it is worth checking what your buyers and insurer expect.
How InfraTech helps
We work with organisations across the UK to get them ready for Cyber Essentials Plus: scoping, a gap review against the five controls, fixing what we find, and preparing for the assessor’s visit. Because we also run managed IT and cyber security services, the controls stay in place after the certificate is issued, which matters now that the director’s declaration covers the whole certification period.
If you have a deadline coming up, find out how our Cyber Essentials Plus support works or get in touch and tell us where you are starting from.
