Cyber Essentials Plus: Independent Technical Verification for UK Businesses

The Two Cyber Essentials Tiers

Cyber Essentials is the UK government's baseline cybersecurity certification scheme. It covers five technical controls: boundary firewalls and internet gateways, secure configuration, access control, malware protection, and patch management. Together, these controls can prevent the majority of common cyberattacks affecting UK businesses.

44% of phishing emails were sent from compromised accounts, helping them bypass authentication protocols — 8% came from within the supply chain (Egress 2024). (Microsoft)

48% of certified organisations said they saved time on cyber security due diligence when dealing with certified suppliers in their supply chain. (UK Government)

Third-party IT risk is a critical vulnerability: the 2023 attack on IT provider CTS simultaneously disrupted multiple law firms — demonstrating how a single supplier compromise can cascade across the sector. (Sra)

Standard Cyber Essentials involves completing a self-assessment questionnaire and having it reviewed by an accredited assessor. Cyber Essentials Plus requires all of this, plus independent technical testing — the assessor physically tests your systems to verify that the controls you declared in the questionnaire are actually in place and working correctly.

What the Technical Assessment Involves

During a Cyber Essentials Plus assessment, the assessor carries out testing on a sample of your in-scope devices. This typically includes: running authenticated vulnerability scans to check patch compliance; attempting to install unauthorised software to verify application whitelisting or restrictive configurations; testing that multi-factor authentication cannot be bypassed; checking that devices do not allow connections to known malicious destinations; and verifying firewall and boundary control configuration.

The assessment covers all device types in scope — Windows and Mac laptops and desktops, mobile devices if they access business data, and any servers within scope. Cloud services used by the business (including Microsoft 365) are also assessed against the Cyber Essentials controls.

Why CE+ Carries More Weight Than Standard Cyber Essentials

Because Cyber Essentials Plus involves independent technical verification rather than self-assessment, the certificate carries more credibility with clients, insurers, and auditors who understand the difference. Supply chain security requirements — particularly in central government procurement, defence, and financial services — increasingly specify Cyber Essentials Plus rather than standard Cyber Essentials.

For cyber insurance purposes, CE+ demonstrates a measurably stronger security posture than standard CE, which can support more favourable underwriting terms. Some insurers specifically ask whether you hold CE+ when assessing risk.

Preparation: What AMVIA Does Before Your Assessment

Most businesses are not immediately ready to pass a CE+ assessment. AMVIA conducts a pre-assessment gap analysis to identify areas that need remediation before the formal assessment. Common gaps include: devices running outdated software or missing patches; MFA not enforced across all accounts; legacy authentication protocols not blocked in Microsoft 365; non-compliant firewall rules; and mobile devices not subject to adequate management policies.

AMVIA remediates identified gaps systematically, retesting each area to confirm resolution before scheduling the formal assessment. This approach significantly reduces the risk of failing the assessment and needing to remediate and retest at additional cost.

Scope Management

Managing the scope of a Cyber Essentials Plus assessment is an important part of preparation. Not every device in your business needs to be in scope — the assessment covers devices that handle organisational data, and scope boundaries can be defined to reflect your actual environment. AMVIA advises on scope definition during the pre-assessment phase to ensure the assessment is proportionate and achievable whilst remaining credible.

Maintaining Your Certification

Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months. AMVIA's managed cybersecurity clients typically maintain their certification status by renewing annually. Where AMVIA manages your security controls on an ongoing basis, the annual renewal assessment is generally straightforward because the required controls are maintained throughout the year rather than implemented immediately before renewal.

Cyber Essentials Plus and AMVIA's Managed Service

Clients on AMVIA's managed cybersecurity service are well-positioned for CE+ certification. Patch management, MFA enforcement, endpoint protection, and email security — all core CE+ requirements — are managed as standard components of the service. AMVIA tracks certification status and proactively prompts renewal before the current certificate expires.