The enhanced tier of the UK government's Cyber Essentials scheme, featuring independent technical verification of all five security controls. Required for UK government contracts involving sensitive data or personal information.
What is Cyber Essentials Plus?
Cyber Essentials Plus is the higher tier of the UK government's Cyber Essentials scheme, backed by the National Cyber Security Centre (NCSC). Unlike the standard Cyber Essentials certification (which is self-assessed), Cyber Essentials Plus requires independent technical verification of all five security controls by an IASME-accredited certification body.
Cyber Essentials Plus is mandatory for UK government contracts involving the handling of sensitive and personal information, and is increasingly required by large enterprises as a minimum security baseline for their supply chain.
The scheme is designed to protect organisations against the most common cyber attacks, which are typically opportunistic and exploit basic security weaknesses. Achieving Cyber Essentials Plus demonstrates that your organisation has implemented robust technical controls against these threats.
Compliance requirements
Cyber Essentials Plus requires independent technical verification of all five controls, going beyond the self-assessment of standard Cyber Essentials.
Install and configure boundary firewalls and internet gateways to protect your network from unauthorised access from the internet.
Ensure computers and network devices are properly configured to reduce vulnerabilities, including changing default passwords and removing unnecessary software.
Control who has access to your data and services, ensuring users only have the access they need and accounts are properly managed.
Protect against malware and other malicious code by using anti-malware software and keeping it up to date.
Keep all software and firmware up to date by applying security patches within 14 days of release for internet-facing systems.
For Cyber Essentials Plus, all five controls are independently verified through hands-on technical testing by an accredited certification body.
Audit process
Netru manages the complete Cyber Essentials Plus certification journey, from initial gap assessment through to independent technical verification and annual renewal.
We define the scope of your Cyber Essentials Plus assessment, identifying all devices, software, and services in scope.
We assess your current controls against all five Cyber Essentials technical controls, identifying gaps before the formal assessment.
Your compliance manager guides remediation of any gaps, ensuring all five controls are fully implemented before the assessment.
We complete the Cyber Essentials self-assessment questionnaire on your behalf, ensuring all responses are accurate and evidenced.
We manage the engagement with an IASME-accredited certification body to conduct the hands-on technical verification assessment.
Upon successful assessment, you receive Cyber Essentials Plus certification, valid for 12 months. We manage annual renewal.
How Netru delivers it
Our UK-based team has deep experience in Cyber Essentials Plus certification. We assess your controls, guide remediation, manage the IASME-accredited certification body, and support annual renewals, ensuring you maintain certification and meet government contract requirements.
Talk to our teamBefore you talk to anyone