Cyber Essentials is a UK scheme covering core protection against common online threats. Cyber Essentials Plus assesses the same technical control areas with independent technical testing as well as the underlying assessment.
What does it cover?
The five areas are firewalls, secure configuration, security update management, user access control, and malware protection. Preparation should use the current requirements and test specification, since the scheme is updated.
Agree the scope carefully
Identify the devices, cloud services, accounts, and remote working arrangements involved. A personal device is not automatically outside scope just because an employee owns it. Check how it is used and what it accesses.
Keep other responsibilities in view
Existing ISO 27001 work may help, but the assessments are different. Cyber Essentials Plus also does not replace privacy obligations, supplier agreements, or a customer’s separate contractual requirements. Confirm exactly what the customer is asking you to demonstrate.