What happens during a Cyber Essentials Plus assessment?

A Cyber Essentials Plus assessment is a practical verification of whether an organisation’s in-scope technology meets the Cyber Essentials requirements. After the scope and assessment arrangements have been confirmed, the assessor examines selected systems, accounts and devices, carries out technical tests, investigates exceptions and documents the outcome.

1. Confirming the assessment scope

The process begins by establishing exactly what the certification is intended to cover. This normally includes the organisation’s internet connection, firewalls or equivalent boundary controls, servers, laptops, desktops, mobile devices, cloud services and user accounts that can access the defined environment.

The assessor will need to understand how the organisation is structured technically. Relevant information may include network diagrams, details of remote access, cloud-hosted systems, office locations, device ownership, administrator accounts and any systems that are deliberately excluded. A system should not be left outside the scope simply because it is difficult to test if it can affect the security of the environment being assessed.

2. Preparing access and representative samples

The organisation provides the access and information needed for testing. This can include test accounts, device details, operating system information, network access and an inventory of in-scope assets. The assessor selects representative devices and accounts rather than examining every item individually.

Sampling means that the organisation must be able to explain how the selected devices and accounts reflect the wider environment. If systems are configured differently, or if some users have additional privileges, those differences may need to be included in the sample. A test account should not be treated as representative if it has fewer permissions or connects to fewer systems than ordinary users.

3. Checking secure configuration

The assessor examines whether devices and services have been configured to reduce avoidable security weaknesses. Checks can include unnecessary services, default settings, administrative interfaces, account permissions, network services and security settings on workstations and servers.

The purpose is not simply to confirm that a security product is installed. The assessor considers whether the relevant controls are configured and operating in a way that prevents unauthorised access. Devices with different roles may be assessed separately because a server, user laptop and network appliance can present different risks.

4. Testing security updates and supported software

Selected systems are checked for operating system and application updates, including whether high-risk or critical vulnerabilities have been addressed within the required timescales. The assessor may review version information, update settings and evidence from management tools, as well as testing the devices themselves.

Unsupported operating systems and applications can create a finding even where other security controls are present. The organisation may need to replace, upgrade or isolate such software, depending on how it is used and whether it falls within the assessment scope.

5. Examining user access controls

User and administrator accounts are reviewed to determine whether access is limited to what each person needs. This can involve checking password arrangements, separate administrative accounts, disabled or removed accounts, privileged access and the treatment of former users.

The assessor may test whether ordinary users can perform administrative actions on sampled devices and whether administrative functions are appropriately restricted. Shared accounts, excessive privileges and accounts that remain active without a business reason can require further investigation.

6. Assessing malware protection

The assessment considers how the organisation protects in-scope devices against malicious software. Depending on the environment, this can include examining endpoint protection, security configuration, update status, central management and the controls applied to devices that access organisational data.

Evidence that a protection tool exists is not necessarily enough. The assessor also considers whether it is enabled, suitably configured and applied consistently to the systems included in the sample.

7. Testing firewalls and internet-facing systems

Internet-facing services and boundary controls are examined for weaknesses that could allow unauthorised access. The assessor may review firewall rules, exposed ports, remote access arrangements and the services accessible from the internet. External testing can identify vulnerabilities in public-facing systems that would not be visible from an internal review.

Remote access receives particular attention because it can provide a route into the organisation’s network. The assessor checks whether it is controlled, appropriately authenticated and limited to the systems and users that require it.

8. Carrying out vulnerability testing

Technical testing is used to identify vulnerabilities in the sampled devices and internet-facing systems. This may include automated scanning and manual investigation of results to determine whether an apparent issue is genuine, relevant and within the certification requirements.

Not every scan result automatically means that certification will fail. The assessor considers the vulnerability, the affected asset, the available fix, the asset’s role and the applicable Cyber Essentials requirements. False positives may be discounted where they can be properly explained, while a weakness that appears minor in isolation may still matter if it provides a route to privileged access.

9. Reviewing findings with the organisation

Potential findings are normally discussed so that the assessor can clarify the configuration and understand the organisation’s explanation. The organisation may be asked to provide additional evidence, demonstrate a control or explain why a device or service is outside the agreed scope.

Where a problem is found, the assessor records the relevant system, control area and reason it does not meet the requirement. The organisation should avoid changing systems during testing unless the assessor agrees, because an unrecorded change can make the results difficult to interpret.

10. Receiving the result and assessment report

Once the testing is complete, the assessor produces the assessment result and supporting report. This records the scope, methods used, systems or samples examined, findings and any conditions relevant to the decision. If the requirements are met, the organisation can proceed with the Cyber Essentials Plus certification outcome through the certification process.

If the assessment identifies a failure, the report should explain what needs attention. Remediation may involve applying updates, removing unnecessary services, changing account permissions, correcting firewall rules, replacing unsupported software or bringing excluded assets into a properly managed scope. Whether a retest or further assessment is available depends on the certification body’s process and the circumstances of the finding.

What the assessment does not cover

• It is not a general review of every business process or every aspect of information security.
• It is not automatically a full penetration test of every application, supplier or cloud service.
• It does not remove the need to manage assets, updates, accounts and security settings after certification.
• It does not make an out-of-scope system secure simply because an in-scope system has passed.

The quality of the result depends heavily on defining an honest scope, maintaining an accurate asset inventory and ensuring that sampled systems reflect the real environment. Preparing those details before the assessment helps the assessor test the right systems and gives the organisation a clearer explanation of any remediation required.