Cyber Essentials Plus

What it is

Standard Cyber Essentials is a verified self-assessment: you describe your controls and an assessor reviews the answers. Cyber Essentials Plus covers the same five controls and adds independent technical testing, which the NCSC describes as more rigorous because it checks the controls work in practice.

The assessor first confirms that the Plus assessment covers the same scope as your valid Cyber Essentials certificate. The NCSC’s test specification then sets out five tests:

1. A remote vulnerability scan of your internet-facing IP addresses
2. An authenticated vulnerability scan of a sample of devices, to check patching
3. Checks that malware protection works on sampled devices
4. A check that every cloud service in scope asks for multi-factor authentication, for both a normal user and an administrator
5. A check that everyday user accounts don’t have administrator rights

The sample of devices has to be representative of everything in scope, so a business with standard laptop builds can usually be covered by testing a handful of them.

Why it matters for a UK small or regulated business

Customers ask for Plus when they want proof rather than a declaration. It is common in government, defence and financial services supply chains. The price depends on the size and complexity of your network, so it is quoted rather than fixed.

How it works in Microsoft 365

The MFA test is where many small businesses stand or fall. The assessor watches a user and an administrator sign in to Microsoft 365 from an untrusted device or a private browser window, and the test only passes if both are prompted for MFA. Old sign-in methods that skip MFA, shared accounts without it and admins working from their everyday account are the usual problems. Managed laptops with automatic updates and Defender running make the patching and malware tests far easier to pass.

How &DEV helps: our cyber assurance uplift for regulated firms aligns your Microsoft 365 setup with Cyber Essentials and Cyber Essentials Plus, and the Microsoft 365 MOT does the same groundwork for general small businesses.