What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is based on a self-assessment questionnaire. Cyber Essentials Plus adds technical verification by the certification body, so weak device control, patching, MFA, and configuration problems become much harder to hide.

Do SMEs need separate preparation for Cyber Essentials Plus?

Usually yes. Plus preparation often needs tighter device coverage, better evidence, and more confidence that the controls are actually working on real machines rather than just written down in policy.

Cyber Essentials Plus

Cyber Essentials Plus Preparation for SMEs

Cyber Essentials Plus is where a lot of businesses find out their controls sound better on paper than they look on real devices. The technical verification stage exposes weak patching, inconsistent MFA, unmanaged laptops, and gaps between policy and practice.

The point of preparation is to find those issues before the certification body does.

Cyber Essentials Service Discuss Plus Readiness

What Usually Causes Trouble in Plus

Device Coverage

The business is not fully clear which endpoints are in scope and whether they are all controlled consistently.

Patching Reality

Updates look fine at a policy level, but specific devices or applications are still behind or unsupported.

MFA and Access

MFA is enabled for some accounts but not all, or privileged access is still messier than the business thought.

Evidence

There is no clean view of what would actually be shown to support the controls during technical checking.

A Sensible Way to Prepare

Keep it short and evidence-led

The cleanest route is usually: confirm scope, check the devices that matter, validate MFA and admin access, confirm patch status, and then tighten any weak evidence or policy wording that does not match the real environment.

That avoids turning Plus into a scramble at the point the technical audit is already booked.

Where to Go Next

Full Readiness Support

If you need proper help before certification, start with the main service page.

Cyber Essentials Service

Questionnaire Help

If you are still at the questionnaire stage, use the simpler readiness path first.

Questionnaire Help