Question 1

What is Cyber Essentials Plus?

Accepted Answer

Cyber Essentials Plus is the independently audited version of Cyber Essentials. An IASME-licensed certification body performs hands-on technical testing of your IT systems to verify that the controls you described in the self-assessment questionnaire actually work in practice. It tests the same five themes: firewalls, secure configuration, security update management, user access control, and malware protection.

Question 2

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Accepted Answer

Cyber Essentials is a verified self-assessment: you answer questions and an assessor reviews your answers. Cyber Essentials Plus adds hands-on technical testing by an independent auditor. The same five themes are tested but the auditor verifies the controls on your real systems, which is where the gap between what organisations believe and what an auditor finds tends to emerge.

Question 3

Why do organisations fail the Plus audit even when they have basic Cyber Essentials?

Accepted Answer

Because self-assessment and technical testing reveal different things. Secure configuration alone accounts for roughly 40% of Plus failures: organisations believe devices are configured correctly, but audit testing finds exceptions, legacy devices out of policy, or controls that work in principle but not for every machine in scope. The Plus audit is designed to find exactly those gaps.

Question 4

Is a PASS on this tool the same as the real certificate?

Accepted Answer

No. This is a readiness signal, not a certificate. Cyber Essentials Plus certification comes only through an IASME-licensed certification body. A PASS prediction here means your self-assessed answers, including the audit-grade checks, are consistent with passing the technical testing. It is the honest picture before you commission the audit.

Question 5

What do you get?

Accepted Answer

You answer across the five themes, including the additional audit-grade checks, and receive a pass or fail prediction at theme level, the exact findings an auditor would write up for every non-pass answer, and a prioritised remediation list.

Question 6

Who should complete this assessment?

Accepted Answer

Ideally the person who knows your IT estate in detail, not just believes it. That may be your IT manager, your outsourced support provider working with you, or your internal IT lead. The audit-grade checks require honest answers about patch state, device lists, and MFA coverage across the whole scope.

Cyber Essentials Plus is the same five controls, independently tested. Would you survive the audit?