Cyber Essentials PLUS
ASK US ABOUT THISCyber Essentials Plus sits at the top of the same UK Government backed scheme as Cyber Essentials and tests the same five technical controls. What changes is how assurance is earned. Rather than trusting what your organisation has written on a form, a qualified assessor gets hands on with your systems and tests them directly.
If Cyber Essentials is a pre MOT checklist you complete yourself, Cyber Essentials Plus is the car actually going up on the ramp. An assessor examines a representative sample of your devices, network and cloud services rather than relying on your description of them.
Put simply, Cyber Essentials just asks whether the right controls have been implemented.
However Cyber Essentials PLUS asks you to prove and show via an independant audit that they actually work.
From a time frame perspective, cyber essentials is required first to be able to gain cyber essentials plus and the plus assessment must be done within 90 days of acheiving the standard cyber essentials.
What Gets Tested
External Vulnerability Testing
Internet facing systems are examined for weaknesses an outside attacker could exploit.
Malware Protection Testing
The assessor confirms malicious files or activity can actually be prevented or detected, not just that antivirus is installed.
Security Update Verification
Sampled devices are checked directly to confirm required updates have been applied and no known vulnerabilities remain exposed.
User Access and Security Controls
Access permissions and configurations are reviewed in practice, not just on paper, to confirm they match what was declared.
Workstation and Device Testing
A representative sample of devices across the certification scope is technically assessed rather than taken on trust.
What Changed Under Danzell
Cyber Essentials Plus assessments are built on the same underlying Cyber Essentials assessment, so the move from the Willow (version 3.2) to the Danzell (version 3.3) question set from 27 April 2026 carries straight through. Automatic failure now applies where MFA is missing on an available cloud service or where a critical or high risk update isn't applied within 14 days.
Cyber Essentials Plus adds a further tightening of its own. If a tested device fails, the assessor now tests a second random sample to check the issue wasn't isolated. A second failure can revoke certification rather than simply flag a gap to fix later. In practice this means fixes need to be applied properly across your whole estate, not just on the machine an assessor happened to look at first.
Why Preparation Matters
Cyber Essentials Plus has far less room for a gap between what's documented and what's actually deployed. A policy might say every device is patched. Testing can still find machines that were missed. An organisation might believe MFA is everywhere. Testing might still find an account or cloud service where it isn't. Because the sample is genuinely random these gaps tend to surface, which is exactly why preparing properly before the formal assessment matters so much.
How LoughTec Prepares You
- Administrative account assessment
- Cyber Essentials Plus readiness assessment
- Endpoint security assessment
- Firewall and network configuration review
- MFA and cloud security review
- Remediation of identified weaknesses
- Scope validation
- Security update and patch review
- Software and operating system review
- Vulnerability assessment
Why Businesses Choose Cyber Essentials Plus
For organisations handling sensitive data or operating in demanding supply chains such as manufacturing, healthcare, construction, professional services and government contracts, this level of assurance is often the difference between winning and losing a tender. It gives boards and finance leads independently verified evidence they can point to when a customer, insurer or regulator asks for more than a self declared statement of security.
Even Cyber Essentials Plus can't guarantee an organisation will never be attacked. Sophisticated phishing, identity compromise and targeted ransomware can all sit beyond its scope. It should sit inside a wider security strategy that includes ongoing monitoring, vulnerability management and staff awareness, not replace one.
Whether you're moving up from Cyber Essentials or certifying for the first time, LoughTec can assess your environment, close the gaps and prepare you for the technical testing itself.
Preparing for Cyber Essentials PLUS under the latest Danzell requirements?
Enquire below to speak to LoughTec about readiness, remediation and certification support.
