The five control themes
Firewalls and internet gateways, secure configuration, user access control, malware protection and security update management form the baseline. Each needs to be demonstrably implemented across the certification scope, not just documented as policy.
The Plus assessment verifies this technically — through vulnerability scanning and internal testing — rather than accepting the self-assessment questionnaire alone, which is the key difference from standard Cyber Essentials.
Where organisations typically trip up
Patch management timelines (critical and high-severity patches applied within the required window) and multi-factor authentication coverage across all in-scope accounts are the two most common gaps found during the verification stage.
Identifying and closing these gaps before the formal assessment, rather than during it, keeps the process to its expected short timeline rather than an extended remediation cycle.
What you receive
A gap assessment against all five control themes, remediation support for the common gap areas, and preparation support through the certifying body's actual technical verification.
Certification is issued by an accredited certification body following their independent assessment, not by this preparation engagement.
Key actions
- Verify patch management meets the required timeline before assessment
- Confirm MFA coverage across all in-scope accounts
- Implement all five control themes demonstrably, not just on paper
- Address common gap areas proactively ahead of technical verification