We often hear from the clients “we are not sure if we are ready for the Cyber Essentials Plus (CE plus)”. In most cases, we come to know that the client doesn’t know what exactly is involved in Cyber Essentials Plus audit. What is Cyber Essentials Plus? What is involved in the audit?

CE plus is the advanced variation of the Cyber Essentials certification. In this certified process, an assessor from the IASME Cyber Certification Body will conduct an on-site (now remote due to the pandemic) audit of the systems. What does the audit involve?

First things first. Cyber Essentials Plus requires the company to pass Cyber Essentials first. Then apply for the Plus for the audit to take place. The audit involves verifying the details on the self-assessment questionnaire. Here is the Cyber Essentials Plus audit process

• Internal Vulnerability assessment
• External vulnerability assessment
• User Access Controls test
• Browser download test
• Email test

DOWNLOAD CYBER ESSENTIALS CHECKLIST

Internal Vulnerability Assessment

At this stage we perform a vulnerability assessment on selected devices. Ideally a portion of the entire device. For example, if you have 100 devices we will check 15 devices. We will be expecting no critical vulnerabilities on the network in order for you to pass the certification. If there is even 1 critical vulnerability then you will not be able to pass the certification unless it’s a false positive. Critical vulnerabilities have the patches available to them and you will need to apply the patches within the 14 days of their release date. Vulnerabilities are categorised as per their CVSS score. The categories are Critical, High, Medium and Low.

We will also be looking for any unsupported software in your environment. You will only pass the certification if there is no unsupported software. For example, if you have Windows 7 operating system on your network you will only pass if there is a Microsoft extended support agreement in place.

It is worth noting that you will need to keep the ‘High’ category vulnerabilities as low as possible.

External Vulnerability Assessment

Essentially this step involves scanning your public IP addresses for any vulnerabilities. Usually the unusual ports left opened. That’s pretty much it.

DOWNLOAD CYBER ESSENTIALS QUESTIONNAIRE