Passing Cyber Essentials Plus: What Independent Hands-On Verification Taught Us About Account Security
Cybersecurity Compliance • Cyber Essentials Plus • Threat Surface Reduction
Strategic Summary: While basic Cyber Essentials involves self-declaration questionnaires, Cyber Essentials Plus requires rigorous, independent technical auditing. Passing our hands-on audit on 16 October, Si Futures verified its endpoint hardening baselines, 14-day patch enforcement, malware prevention controls, and total administrative account separation.
Challenge: Self-Declaration vs. Independent Audit Proof
If you think Cyber Essentials Plus is simply an extended version of the basic Cyber Essentials questionnaire, it isn’t. Cyber Essentials is telling an assessor what controls you have implemented; Cyber Essentials Plus is an independent auditor physically testing your devices to verify that it’s true.
Cyber Essentials Plus is the audited tier of the UK government-backed Cyber Essentials scheme. It covers the same five controls as the basic certificate, but an independent assessor tests your devices directly instead of reading your answers. The lessons below apply wherever your organisation operates.
The Account Control That Catches Businesses Out
The control that most frequently trips up organisations during an audit is administrative account separation. Standard daily accounts used for email and web browsing must never hold administrator privileges. When elevated rights are required, Windows must prompt for explicit admin credentials. If a daily account is compromised by ransomware or phishing, strict account separation ensures the threat remains strictly contained.
Inside the Cyber Essentials Plus Technical Audit
Meeting our fixed accreditation deadline required disciplined technical execution:
- Endpoint Sampling & Verification: The assessor installed remote tools across sampled endpoint laptops to verify hostnames and gather evidence directly.
- Automated Vulnerability Scanning: Deep application scans evaluated installed software, Windows updates, active machine policies, and verified that critical security patches were deployed within 14 days of release.
- Hardening & Malware Execution Tests: Machine settings were checked against baseline hardening standards (such as disabled autoplay), while active malware test payloads were executed to verify endpoint protection blocking.
Figure 1: Comparison between combined daily/admin access versus strict account separation, highlighting attack containment.
Preparing Your SME for Audit Success
To successfully pass a Cyber Essentials Plus technical assessment, focus on three foundational pillars:
- Centralised Device Management: Deploy MDM tooling capable of enforcing consistent hardening policies and patch schedules across all remote endpoints.
- Strict Privilege Controls: Enforce zero-tolerance policies regarding permanent administrator rights on daily user profiles.
- Legacy Software Remediation: Identify and eliminate unsupported software components (e.g., deprecated Node.js versions) that cannot receive active security patches.
Preparation Investment & Next Steps
Preparation effort depends directly on your current device management maturity and software posture. Because certificates are valid for 12 months, maintaining continuous compliance discipline is essential.
We have documented our complete audit playbook—covering scope definition, sampling protocols, and evidence collection—to help our clients pass their assessments seamlessly.
If you are evaluating Cyber Essentials Plus for your organisation, you can discuss your Cyber Essentials Plus readiness with our team, or explore how our managed cybersecurity services maintain continuous compliance.
