When it comes to protecting your business from cyber threats, Cyber Essentials Plus is often seen as a gold standard. But what many business owners don’t realise is that meeting the Cyber Essentials Plus requirements isn’t as simple as ticking off a checklist. It involves real planning, testing, documentation and technical controls that, if done incorrectly, can lead to failed audits, wasted time and ongoing vulnerabilities.
So, if you’re thinking of managing it yourself, you may want to read this first.
What Is Cyber Essentials Plus?
Cyber Essentials Plus is the more advanced version of the Cyber Essentials certification. While the basic version involves a self-assessment, Plus includes an independent technical audit. That means someone will test your systems, your setup and your security – not just take your word for it.
The aim? To demonstrate that your organisation not only understands cyber security but actively implements it in a measurable, consistent way.
What Are the Cyber Essentials Plus Requirements?
To pass Cyber Essentials Plus, your business must already be Cyber Essentials certified. Then, the following technical areas are assessed by an external auditor:
1. Boundary Firewalls and Internet Gateways
Your internet-facing devices must be properly configured to block unauthorised access. Firewalls must be up to date and correctly set up.
2. Secure Configuration
All devices must be configured to reduce vulnerabilities – unnecessary software or services should be removed or disabled.
3. Access Control
Only authorised users should be able to access your systems. You must demonstrate user account management, least-privilege access and password policies.
4. Malware Protection
Devices need to have effective anti-malware software, or you must use application whitelisting to tightly control what runs on your systems.
5. Patch Management
All software and operating systems must be fully up to date, and critical updates should be applied within 14 days of release.
But here’s the catch – it’s not just about showing you do these things. It’s about proving it.
What Does the Audit Involve?
The audit is hands-on and involves:
- Scanning your devices and servers
- Verifying your patching schedules
- Testing antivirus effectiveness
- Reviewing how your users log in and how privileges are assigned
- Inspecting your firewall and network configuration
You’ll also need to show that all these protections are applied consistently across every device in scope – which, if you haven’t been tracking closely, could be a significant challenge.
Why Doing It Alone Might Be a Bad Idea
Many businesses assume they can manage Cyber Essentials Plus requirements themselves to save costs. Unfortunately, this usually leads to more expense down the line.
Here’s why it’s risky:
- Time-consuming prep – Auditors won’t guide you through the process. They’ll expect your setup to be ready on day one.
- Technical knowledge gaps – Without expertise in patching schedules, endpoint security, and network architecture, businesses often fall short.
- Unexpected failure – It’s not uncommon to fail the first time, especially if you’ve misunderstood the scope or requirements.
- Incomplete documentation – Auditors expect proper evidence, not assumptions.
That’s where a partner like Marshall comes in. We understand the Cyber Essentials Plus requirements inside and out, and we help businesses meet them efficiently.
What Happens If You Fail?
Failure doesn’t just mean you don’t get the certification – it can also:
- Delay contract opportunities (especially with government or regulated sectors)
- Damage your reputation if a breach occurs later
- Waste time and internal resources
- Require you to repeat the entire process (including paying for re-audit)
In contrast, working with a qualified partner means you can identify gaps early, fix them, and go into the audit with confidence.
The Business Benefits of Getting It Right
When done properly, achieving Cyber Essentials Plus can help your business:
- Win new clients and contracts
- Reduce cyber insurance premiums
- Lower the risk of ransomware or phishing attacks
- Show clients and stakeholders that you take cyber security seriously
It becomes a powerful part of your business credibility – and that’s not something to gamble with.
Let Marshall Help You Get Certified
At Marshall, we don’t just prepare you for certification – we help you build security that works long after the audit ends. Our cyber security experts will:
- Conduct a readiness assessment
- Fix gaps before the audi
- Guide you through every requirement
- Liaise with the external certifying body on your behalf
You don’t have to do this alone.
VIEW CYBER ESSENTIALS PLUS PACKAGE
Meeting the Cyber Essentials Plus requirements isn’t impossible, but it is technical, time-consuming and easy to get wrong. If you’re thinking about certification, get support from a provider who knows what to expect and how to get you there quickly and securely.
Don’t just meet the minimum – build a secure, scalable environment that serves your business now and in the future.
Call us on 0203 384 9832 or email enquiries@marshallinfotech.com
