Cyber Essentials Plus support

Cyber Essentials Plus gives your customers, suppliers and partners independent assurance that key cyber security controls are in place and working.

Our aim is simple: get you ready, get the controls in place and help you achieve certification.

Getting through the assessment can be straightforward when the environment is well prepared. It can also uncover issues with patching, unsupported software, administrator access, endpoint security, firewall configuration or device management.

InfraTech Systems helps you identify those issues, fix them and prepare properly for the assessment. We review your environment against the Cyber Essentials requirements, explain what needs to change and help implement the necessary controls.

Once you are ready, we work with an independent Cyber Essentials Plus assessor and support you through the certification process.

Cyber Essentials is the UK Government-backed cyber security certification scheme developed by the National Cyber Security Centre. It focuses on five core technical areas:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

Cyber Essentials Plus covers the same requirements as Cyber Essentials, with technical testing carried out by an independent assessor. The assessor checks that the controls you have declared are actually in place and working across a representative sample of your systems and devices.

For customers and suppliers, that gives a stronger level of assurance that your basic cyber security controls have been implemented properly.

A common problem with Cyber Essentials projects is knowing what needs to change technically. The questionnaire may identify the requirement, but somebody still has to understand the environment, work out the correct fix and make sure the change does not cause problems elsewhere.

That is where we come in. We review your current setup, identify gaps against the Cyber Essentials requirements and work with your team to fix them. Depending on your environment, that could include changes across:

• Microsoft 365
• Microsoft Entra ID
• Microsoft Intune
• Windows endpoints
• Servers
• Firewalls
• Remote access
• Endpoint security
• Patch management
• Administrator access
• Mobile devices
• Cloud services

We explain what needs to change, why it matters and what the effect will be. Where appropriate, we can make the technical changes ourselves or work alongside your existing IT team.

Seven steps from scoping to certificate, with us involved at every one.

• 01

  Scope

  We start by understanding what needs to be included in the certification: your users, devices, networks, cloud services, internet-facing systems and the way people access company data. Getting the scope clear at the start helps avoid problems later in the assessment.
• 02

  Review

  We assess your current controls against the Cyber Essentials requirements and look for anything that may cause an issue during the Cyber Essentials Plus assessment. That often includes unsupported operating systems or software, missing security updates, local administrator access, weak account controls, missing multi-factor authentication, poorly configured firewalls, inconsistent device configuration, endpoint security gaps, unmanaged devices and internet-facing services.
• 03

  Agree

  We give you a clear list of the changes needed before assessment, and we keep it practical. You will know what the issue is, what needs to change and why.
• 04

  Fix

  We help implement the required changes. That may mean working with your internal IT team, your existing MSP or making the changes directly ourselves. The work is focused on getting the environment into a position where it meets the Cyber Essentials requirements and is ready to be tested.
• 05

  Check

  Once the remediation work is complete, we review the environment again. This gives us a chance to identify anything that could still cause a problem before the independent assessor begins testing.
• 06

  Assess

  We coordinate with an independent Cyber Essentials Plus assessor for the formal assessment and stay involved throughout. If the assessor needs clarification, evidence or technical changes, we work with you to deal with them.
• 07

  Certify

  Once the assessment has been completed successfully, the Certification Body issues your Cyber Essentials Plus certificate.

Our service is outcome based. We are there to help you achieve Cyber Essentials Plus certification, which means we stay focused on the things that could stop you passing and help you get them resolved. You will have a clear view of:

• What needs to change
• Why it needs to change
• Who is responsible for fixing it
• What still needs to be completed before assessment
• Whether the environment is ready for the assessor

For many customers, the biggest value comes from having somebody who can understand the Cyber Essentials requirement and then translate it into a real technical change.

A large part of Cyber Essentials Plus readiness now sits within cloud and endpoint management platforms. For organisations using Microsoft technologies, we can review and remediate controls across areas including:

• Microsoft 365
• Microsoft Entra ID
• Microsoft Intune
• Microsoft Defender
• Azure
• Conditional Access
• Multi-factor authentication
• Windows device configuration
• Administrator access
• Device compliance
• Patch management

This is especially useful where the Cyber Essentials requirement is clear, but the correct Microsoft configuration is less obvious. We can help work out the safest and most practical way to meet the requirement without creating unnecessary disruption for users. More on our Microsoft 365 service.

• Already have Cyber Essentials?

  We help you prepare for the Plus technical assessment: we review the environment, identify any remaining gaps and help fix them before the assessor begins testing.Plan your Plus assessment

• Starting from the beginning?

  We can help with the whole process: scope, review, remediate, prepare, assess and certify, with the technical changes made to get you ready.Start with a review

• Not sure which applies?

  Tell us where you are and we will tell you what applies to your environment and what needs to happen next.Book a free consultation

Cyber Essentials is required before Cyber Essentials Plus, and the Plus assessment would normally be completed within three months of achieving Cyber Essentials.

Cyber Essentials Plus can help demonstrate that your organisation has taken practical steps to protect its systems and data. It can also help with:

• Customer security requirements
• Supplier assurance
• Tender and procurement requirements
• Government and public sector contracts
• Cyber insurance discussions
• Supply chain security reviews

For many organisations, it also provides a useful baseline for improving security more generally. The certification process often highlights weaknesses that are worth fixing anyway, including poor patching, excessive privileges, unmanaged devices and unsupported software.

Certification proves a baseline. Our managed cyber security service is what keeps it true between assessments.

If you are planning to achieve Cyber Essentials Plus, we can help you understand where you are today and what needs to happen next. We will review your environment, identify the gaps, help fix them and work with the independent assessor through to certification.

Related: Cyber security for monitoring, detection and response, and Microsoft 365 for licensing, security and adoption.