Cyber Essentials Plus: What It Involves & How to Pass First Time

Cyber Essentials Plus looks intimidating at first glance. There is a hands-on audit, real technical testing, and the possibility of being told to fix issues before you can pass. The good news is that with the right preparation, you can pass the first time without halting business operations. In this guide, you will learn what CE Plus is, what the assessment involves, realistic costs for UK SMEs, how long to allow, common reasons for failure, and a practical step by step plan to get ready. You will also see how Jedi Services helps you prepare, remediate, and liaise with assessors so the day itself is calm and predictable.

What is Cyber Essentials Plus?

Cyber Essentials Plus is the audited, hands-on version of the UK Government backed Cyber Essentials scheme. It verifies that your organisation has the five core technical controls in place, and that they work in practice across real devices and accounts. The five control areas are:

• Secure configuration
• Boundary firewalls and internet gateways
• Access control and MFA
• Malware protection, typically modern EDR or equivalent
• Patch management and vulnerability management

Unlike the self-assessed Cyber Essentials, Plus includes technical testing by an independent assessor. They will sample endpoints, run internal and external vulnerability scans, inspect your EDR status and policies, check MFA on cloud services, attempt common attack paths, and review patching cadence and completeness.

Is it the same as ISO 27001? No. ISO 27001 is a full information security management standard focused on risk management, policy, and continuous improvement across people, process, and technology. CE Plus is narrower, technical, and control based. Many SMEs start with CE Plus to prove good security hygiene, then progress to ISO 27001 when they need broader governance and client assurance.

Is Cyber Essentials Plus worth it?

For most UK SMEs, yes. Here is why:

• It provides independent validation that your basic controls work, which reduces breach likelihood and impact.
• It is increasingly requested in tenders, supply chain questionnaires, and by cyber insurers.
• It is practical. The controls align with what you should do anyway to lower risk and keep staff productive.
• It creates a credible baseline before you layer on extra controls or pursue ISO 27001.

If you already operate strong controls, CE Plus is an efficient way to demonstrate that capability. If you are earlier on the journey, the preparation work is a focused roadmap that will lift your security posture quickly.

What the CE Plus assessment involves

Expect a structured, technical review. Typical activities include:

• Scoping confirmation: which networks, devices, users, and cloud services are in scope. Remote workers and BYOD rules must be clear.
• External vulnerability scan: public facing IPs and services are tested for known issues and configuration weaknesses.
• Internal vulnerability scan: sample endpoints are scanned on the internal network to validate patching and configuration.
• EDR checks: assessors verify you run approved endpoint protection, that it is active and up to date, and that policies prevent execution of common malware types.
• MFA verification: accounts for critical cloud services, such as Microsoft 365, must enforce MFA for all users in scope.
• Patch and update review: operating systems and third party software must meet patch windows. Missing critical updates are a common cause of failure.
• Account hygiene: checks on local admin usage, default passwords, and whether unused accounts are disabled or removed.
• User simulation activities: simple phishing or malware delivery checks may be included to verify that controls respond correctly.

You will be asked to provide evidence from consoles and sample devices. The assessor will also run their own tools to cross check.

Common reasons organisations fail

• Unsupported or end of life operating systems present in scope
• Missing critical patches on Windows, macOS, browsers, or common apps such as Java or Adobe Reader
• Gaps in MFA coverage, for example break glass accounts or service accounts without compensating controls
• EDR not deployed everywhere, or tamper protection disabled on some devices
• Weak local admin practices, shared accounts, or default credentials left unchanged
• Shadow IT services that fall in scope but are not controlled or monitored
• Poor asset inventory, leading to devices being missed during patching

Each of these is fixable with preparation and a tidy asset list.

How much does Cyber Essentials Plus cost?

Pricing varies by scope and assessor. For UK SMEs, realistic ballparks are:

• Micro businesses with a small, simple scope: £1,000 to £2,000 for assessment, plus any CE basic fee if needed
• Typical SME with mixed desktops, laptops, and Microsoft 365: £2,000 to £4,000
• Multi site or larger scopes with servers and remote workers: £4,000 to £7,000+

You should also budget for remediation and pre assessment readiness work. That effort can range from a few hundred pounds for quick fixes to several thousand if you need to roll out EDR, enforce MFA, or upgrade devices. Tooling such as managed endpoint protection, patch management, and backup are ongoing operational costs that bring value beyond the certification.

Preparation timeline you can trust

A sensible plan for a typical SME looks like this:

• Week 1, scope and gap check: confirm scope, gather an asset list, review current controls, and run discovery scans.
• Weeks 2 to 3, remediation: fix patch gaps, enable MFA for all, deploy or standardise EDR, remove local admin, and harden baselines.
• Week 4, internal pre test: run internal and external scans, verify EDR coverage, spot check devices, and correct any stragglers.
• Week 5, book the assessment: provide evidence pack and proceed to the formal audit.

Some organisations can compress this into two or three weeks if the foundations are already strong. Others will take longer if device upgrades are required.

Step by step pre assessment plan

Use this checklist to remove surprises:

• Confirm scope and ownership: List in scope domains, public IPs, offices, and remote workers. Decide whether BYOD is allowed, and if so, define controls.
• Build a clean asset inventory: Capture every endpoint, OS version, and installed software baseline. Tag high risk or legacy devices for special handling.
• Enforce MFA everywhere: Apply conditional access to require MFA for all cloud accounts. Protect break glass accounts with strong controls and alerting.
• Standardise EDR and AV: Deploy a supported EDR to all devices. Enable tamper protection. Create policies that block common ransomware behaviours.
• Patch to a clear standard: Set patch windows that meet CE timelines for critical and high severity updates. Include browsers, Java, Adobe Reader, and other third party software.
• Lock down admin rights: Remove local admin from users. Use just in time elevation if needed. Rotate and store admin credentials securely.
• Tidy configuration: Disable or remove unused accounts and services. Enforce secure configuration on firewalls and Wi Fi, including strong encryption and passwords.
• Prove it with pre scans: Run internal and external scans. Fix findings and rerun. Export EDR and MFA coverage reports as evidence.
• Brief your team: Let staff know the assessment date and what to expect. Ensure devices are online and reachable on the day.

Is ISO 27001 the same as Cyber Essentials Plus?

No. ISO 27001 is a management system standard that covers governance, risk, policy, and continual improvement across your entire information security environment. It takes longer, involves internal audits, and is broader in scope. Cyber Essentials Plus focuses on technical controls and evidence that they work. Many SMEs use CE Plus to prove a solid baseline, then adopt ISO 27001 when customers and regulators expect a formal ISMS.

How Jedi Services helps you pass first time

You do not need to tackle this alone. Jedi Services provides:

• Readiness audits: we review your environment against CE Plus controls, confirm scope, run discovery scans, and produce a clear gap report.
• Remediation and hardening: we help you enforce MFA, deploy EDR, patch devices, remove local admin, and secure cloud and network configurations.
• Evidence and liaison: we prepare evidence packs, coordinate with assessors, and manage device access on the day to minimise disruption.
• Ongoing management: after you pass, we keep you compliant with continuous patching, monitoring, and incident response support.

If you want a quick primer on the underlying scheme and what it covers, our page on cyber essentials is a good starting point.

Final takeaways

Cyber Essentials Plus is a practical, high impact certification for UK SMEs. It proves that your core security controls work on real devices. To pass first time, get the scope right, fix patch gaps, enforce MFA everywhere, standardise EDR, and run your own internal and external scans before the assessor arrives. Give yourself four to five weeks if you are starting from scratch, or move faster if your controls are already mature. If you want expert help to keep the process smooth and disruption free, Jedi Services is ready to guide you from readiness to pass.