Multi-Year Cyber Essentials and Cyber Essentials Plus Certifications

Cyber Essentials Plus involves both internal and external tests of your network and computers. It will involve a visit to your site/a remote audit and gives more assurance that you are complying with the Cyber Essentials Scheme than the basic self assessment level.

You will need to complete your Cyber Essentials Plus audit within 3 months of your last Cyber Essentials basic certification. Both these can also be completed at the same time.

The key elements of a Cyber Essentials Plus audit can be summarised as follows:

• An assessor will pick a sample of computers at your organisation and perform an audit to ensure that the devices are configured as per the scheme.
• A vulnerability scan will be performed on these machines to confirm patching and basic configuration is at an acceptable level
• An external port scan of your internet facing IP addresses will be conducted to ensure no clear and obvious misconfigurations or vulnerabilities can be identified.
• A test will be conducted on your default email/internet browser to confirm how well configured they are to prevent execution of fake malicious files.
• Screenshots will be taken as evidence that the system is Cyber Essentials compliant.

If you would like to bid for central government contracts which involve handling sensitive and personal information or the provision of certain technical products and services, you may require Cyber Essentials Plus Certification. More information is available on the gov.uk website.