Cyber Essentials Plus

Cyber Essentials is the government-backed scheme that the NCSC describes as the minimum level of cyber security it recommends for organisations of every size. It is built on five technical controls that stop the most common internet-based attacks:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

There are two levels. Basic Cyber Essentials is a self-assessment questionnaire. Cyber Essentials Plus checks the same controls, then an assessor independently tests your systems to confirm they work in practice. The scheme is owned by the NCSC and delivered by IASME, which licenses the certification bodies that carry out assessments.

The usual trigger is a customer or contract. Government suppliers bidding for certain contracts are asked to hold Cyber Essentials or Cyber Essentials Plus under the government’s procurement policy note, and many private-sector buyers ask their suppliers for it too. The NCSC’s cyber insurance guidance also notes that some insurers look favourably on recognised defences such as Cyber Essentials.

If a contract names a level, check which one. A requirement for Plus is not met by the basic certificate.

The Plus audit follows the NCSC’s published test specification. The assessor checks a representative sample of your devices and internet-facing systems against the five controls, with the aim of showing whether an opportunist attacker using common, low-skill methods could get in. The result is pass or fail, and a certificate.

A penetration test works the other way round. You set the scope (an application, your perimeter, your internal network, a cloud account), and the tester looks for weaknesses of any kind within it, including ones specific to how you built and run things. The result is a report of findings ranked by risk, with no certificate.

Purpose

Cyber Essentials Plus: Certify that baseline controls work

Penetration test: Find and explain weaknesses in a chosen scope

Method

Cyber Essentials Plus: Fixed test specification from the NCSC

Penetration test: Scoped with you; manual-led and open-ended

Scope

Cyber Essentials Plus: The scope of your Cyber Essentials certificate, sampled

Penetration test: Whatever you agree: apps, networks, cloud, mobile

Outcome

Cyber Essentials Plus: Pass or fail, and a certificate

Penetration test: Findings report with risk ratings and fixes

Who carries it out

Cyber Essentials Plus: An IASME-licensed certification body

Penetration test: A testing firm you choose, often CREST-accredited

Neither replaces the other. Cyber Essentials Plus shows the basics are in place across the organisation; a penetration test shows how a specific system holds up against a skilled attacker. See vulnerability assessment vs penetration testing for the same distinction in general.

Most of the work is done before the assessor arrives. Before you book:

• Hold a current basic certificate. The Plus audit has to follow it within a set period; your certification body will tell you how long.
• Confirm the scope. The audit tests the scope on your Cyber Essentials certificate. If you certified a subset of the organisation, it must be properly separated from the rest, as IASME’s scope guidance explains.
• List your devices. Keep an up-to-date list of the laptops, desktops, phones, servers and cloud services in scope, with their operating systems and versions. The assessor samples from it.
• Update everything. Check that every device and application in scope is supported by its vendor and has its security updates applied.
• Check malware protection and accounts. Make sure malware protection is running, and that people use standard accounts day to day rather than administrator accounts.
• Turn on multi-factor authentication for your cloud services.

Ask your certification body for the current requirements document and the test specification before you start. The scheme’s requirements are updated from time to time, and the body will assess you against the version in force on the day.

Only an IASME-licensed certification body can certify you. Check the body is listed on IASME’s network directory and is licensed for Cyber Essentials Plus. Then ask each one:

• Is the audit on site, remote, or a mix, and how will they select the sample?
• What happens if a test fails: how long do you have to fix it, and is a retest included?
• Will they also help you prepare, and if so, how do they keep the assessment independent?
• Can they run a penetration test alongside, if a customer or insurer asks for one too?

Many penetration testing firms also hold Cyber Essentials Plus themselves. Our directory can show firms that list Cyber Essentials Plus, but that is the firm’s own certificate, not a licence to certify others, so always confirm the licence on IASME’s directory. To check a supplier’s certificate, use IASME’s certificate search.