Prepare the estate for assessment.

Agree which devices, users and services are in scope. Then review the five technical controls and the evidence supporting your answers.

Which certificate does your customer require?

The wording in the tender or contract determines whether to prepare for Cyber Essentials or Cyber Essentials Plus.

The certification requirement

Cyber Essentials: Prepare the verified self-assessment of the five technical controls for the agreed estate.
Cyber Essentials Plus: Prepare for independent testing of the same controls on systems in scope. Confirm the audit timetable with the certification body.
Bring to the review: The exact customer requirement, device and cloud inventory, control owners and required certification date.

Read the service guide (PDF) ↗ · NCSC scheme overview

Engagement scope

What the preparation covers

Choose the certificate your customer needs

Check the tender or customer request before choosing. Cyber Essentials uses a verified self-assessment of five technical controls. Cyber Essentials Plus adds independent testing of those same controls on systems in scope. If the request specifies Plus, plan the audit with your certification body within three months of your Cyber Essentials certification.

Define the boundary

Identify business devices, user accounts, cloud services and remote working arrangements that fall inside the proposed scope.

Check the controls

Review firewalls, secure configuration, security update management, user access control and malware protection with the people responsible for each area.

Preparing for your first assessment or renewing an existing certificate?

Discuss Cyber Essentials ↗