Cyber Essentials and Cyber Essentials Plus support

Turn a customer requirement or certification deadline into a practical action plan. CIS helps businesses prepare for Cyber Essentials and Cyber Essentials Plus through gap reviews, remediation and evidence gathering.

Preparation starts with understanding your organisation’s systems, the certification you need and the deadline you are working towards. Review devices, software, cloud services and existing security arrangements against the current scheme requirements.

CIS can help you identify improvements, plan the technical work and gather the information needed for the assessment. Agree who owns each action, what can be addressed quickly and which changes need more time.

Your proposal should distinguish preparation and remediation work from the independent assessment and certification fees.

Both certification levels assess the same five technical controls. Cyber Essentials uses a verified self-assessment. Cyber Essentials Plus adds independent technical testing to check the controls in practice.

Confirm the level required by your customer or tender, and use the current requirements when planning the work. The NCSC Cyber Essentials overview explains the scheme and routes to certification.

CIS’s support focuses on preparation, technical improvements and evidence. Certification depends on meeting the scheme requirements and completing the relevant assessment.

An engineering client sought Cyber Essentials and Cyber Essentials Plus to support its ambitions to work with larger customers. Ageing hardware, operating systems and SQL Server infrastructure needed attention.

CIS supported staged upgrades and configuration changes. The published case study records improved system performance and fewer support tickets alongside the security work.

Read the engineering Cyber Essentials preparation case study for the challenge, work completed and reported outcomes.

Preparation can uncover work that belongs in your wider IT plan, such as replacing unsupported technology, improving device configuration or clarifying access responsibilities.

Connect those actions with managed IT support or co-managed IT support. Use vulnerability management to support ongoing prioritisation of weaknesses.

Certification is one part of your security approach. Keep detection and response and backup and recovery aligned with the risks to your business.

The scope depends on the size and complexity of your environment, its current condition and the changes required. Legacy systems, unclear inventories and restricted change windows can affect the preparation plan.

Bring your previous assessment, existing certificate if applicable, device and software information, and any customer deadline to a discussion. We can then agree the support, responsibilities and budget for the work.

Tell us which certification level you need, your deadline and the systems involved. We can help you define the gaps, remediation work and next steps.