Buyer guide
Cyber Essentials Plus audit preparation checklist
Cyber Essentials Plus independently tests the implementation of the same five technical controls used in Cyber Essentials. Preparation should therefore focus on evidence that the controls are operating consistently across the agreed scope.
Before booking the audit
- Confirm the systems, cloud services, locations and users in scope.
- Identify unsupported operating systems or applications and address them appropriately.
- Check firewall and network-device configuration.
- Review user and administrator privileges.
- Confirm multi-factor authentication where current requirements call for it.
- Verify security updates are being deployed within the scheme requirements.
- Confirm malware protection or approved alternative controls are operating.
Do not optimise only for the test day
The strongest preparation is operational: know who owns patching, account management, device inventories and cloud configuration. Use the current NCSC Requirements for IT Infrastructure rather than an old checklist copied from a blog.
Official references: NCSC Cyber Essentials overview and NCSC requirements/resources.
CE+ preparation timeline
Stabilise scope
Reconcile devices, cloud services, internet gateways, internet-facing servers and unsupported software. Resolve scope ambiguity before testing.
Close control gaps
Review patch status, administrator accounts, MFA, firewall rules, malware protection and representative devices likely to be available for testing.
Prepare evidence
Have responsible staff, test devices, configuration evidence and remediation contacts available so avoidable delays do not become audit-day problems.
Evidence pack
- Current asset and scope list.
- Patch/update evidence for sampled systems.
- MFA and administrator-account evidence.
- Firewall/router configuration ownership.
- Malware-protection or application-control evidence.
- Documented remediation owner for any known issue.