Confirm the prerequisite
Check the underlying Cyber Essentials certificate and the Plus assessment window
01 / Technical Audit Certification
Evidence Beyond the Questionnaire
Cyber Essentials Plus confirms that the security controls described in the questionnaire work in practice.
Prepare representative systems
Ensure patches, MFA, configurations and protection operate across the relevant devices
Independent technical audit
Undertake testing and address any findings in line with current scheme rules
The assessment route and certification decision are governed by the current scheme requirements.
02 / Find Your Route
Choose the Assurance Your Organisation Actually Needs
Some organisations need a verified baseline for procurement. Others need Plus technical testing. NCSC Cyber Advisor support helps implement controls but is a separate service from independent certification assessment.
Cyber Essentials
Verified self-assessment against the five controls
Discuss this certification route ↗Cyber Essentials Plus
Independent technical audit following Cyber Essentials
Discuss this certification route ↗NCSC Cyber Advisor
Practical help implementing the technical controls, whether or not certification is immediately required
FeatureCyber EssentialsCyber Essentials Plus
Five technical controlsYesYes
Verified self-assessmentYesYes
Independent technical testingNoYes
Valid for12 months12 months
03 / The Five Controls01 / TECHNICAL CONTROL 02 / TECHNICAL CONTROL 03 / TECHNICAL CONTROL 04 / TECHNICAL CONTROL 05 / TECHNICAL CONTROL
Five Essential Controls One Clear Security Baseline
All Cyber Essentials assessments cover these five security themes, and the Plus assessment checks their practical operation on the in-scope infrastructure.
Firewalls
Control traffic and protect the boundary of your devices and networks
Secure Configuration
Remove unnecessary services and insecure defaults
Security Update Management
Keep operating systems, applications and other software securely updated
User Access Control
Apply least privilege and strong authentication, including MFA
Malware Protection
Limit the execution and impact of malicious code
04 / Scheme Update
Danzell 2026 What Has Changed
IASME's Danzell question set applies to assessment accounts created from 27 April 2026, alongside NCSC Requirements for IT Infrastructure v3.3. The most consequential changes concern mandatory MFA and timely installation of high-risk or critical updates.
For Plus, update-management retesting now includes a new random device sample, so repairing only the original failed sample is not enough.
Review the official questions ↗Danzell question set
Applies to assessment accounts created from 27 April 2026, alongside Requirements for IT Infrastructure v3.3
Cloud MFA
Where a cloud service offers MFA, failure to enable it is an automatic-fail condition
Security updates
Critical and high-risk security updates must be applied within 14 days, with automatic-fail marking for key questions
Cloud and scope
Relevant cloud services remain in scope and must not be excluded simply because they are hosted externally
05 / Assessment Method
A Defined Route From Preparation to Certification
The most efficient assessment follows the real systems and scheme requirements, not a generic questionnaire checklist.
01
Confirm a valid Cyber Essentials certificate
Understand the compliance or contract requirement and the actual security environment.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
02
Agree scope and representative devices
Confirm the relevant systems, users, services and responsibilities.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
03
Prepare technical controls and supporting access
Review the controls and gather credible current-state information.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
04
Complete the independent Plus technical audit
Work through technical or evidence gaps with the responsible teams.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
05
Remediate findings across the in-scope environment
Carry out the agreed assessment or technical assurance route.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
06
Undertake required retesting and renew annually
Document outcomes and prepare for ongoing control maintenance.
PROGRESS CHECKEvidence and responsibilities establishedCertification subject to independent assessment criteria
06 / Practical Readiness
Understand the Scope Before You Submit
Certification boundaries must reflect the organisation and its real technology, including relevant cloud services and user access. NCSC Cyber Advisor support can help teams make changes before an independent certification assessment.
2-sec / CONTROL WORKSPACEFrom scope to
01 FirewallsREVIEW 02 Secure ConfigurationREVIEW 03 Security Update ManagementREVIEW 04 User Access ControlREVIEW Illustrative assessment planning, not a certification result
From scope to
control evidence
07 / Independent CredentialsIASME APPROVAL NCSC ASSURANCE
Two Distinct Credentials One Practical Route to Readiness
2-sec reports both IASME approval as a Cyber Essentials Certification Body and assurance as an NCSC Cyber Advisor service provider. They address different jobs and should not be confused.
Cyber Essentials Certification Body
An approved Certification Body assesses the Cyber Essentials requirements and can issue certification where scheme criteria have been met.
Cyber Advisor Assured Service Provider
Cyber Advisors provide practical implementation advice and hands-on support for the five technical controls. Advice and certification assessment are distinct roles.
The NCSC Cyber Advisor scheme is operated through IASME as delivery partner. The service-provider designation should match 2-sec's current official scheme listing.
08 / What Happens NextBASELINE HIGHER ASSURANCE IMPLEMENTATION HELP
Start With the Requirement Not a Bigger Project
Tell 2-sec what you need certification for, when it is required and which systems are in scope. A suitable route can then be discussed.
Cyber Essentials
Verified self-assessment and annual renewal
Cyber Essentials Plus
Independent technical testing of the same five controls
NCSC Cyber Advisor
Practical assistance with technical control configuration
09 / Buyer Questions
Cyber Essentials Questions Answered Clearly
Understand the current scheme and the distinction between certification assessment and technical implementation support.
What is Cyber Essentials Plus?
Cyber Essentials Plus adds independent technical assessment of the five control areas to a valid Cyber Essentials self-assessment certificate.
Do we need Cyber Essentials first?
Yes. The underlying Cyber Essentials certification normally must be no more than three months old when the Plus audit takes place.
What is tested?
Assessors examine relevant systems and representative devices using the current technical audit method, including checks related to updates, malware protection and secure configuration.
Can the audit be performed remotely?
The audit approach depends on the environment, testing arrangements and requirements of the Certification Body.
What changed in the 2026 Plus audit?
IASME changed retesting after a security update management failure so an additional random sample is included, rather than checking only the initially failed devices.
Does Plus replace penetration testing?
No. Plus tests the Cyber Essentials baseline; an in-depth penetration test can examine attack paths and risks outside the scheme's technical audit.
10 / Your Next Move
Choose Your Next Step With Confidence
Discuss your certification requirements, in-scope systems and practical readiness with 2-sec.