Cyber Essentials Plus adds an on-site (or remote) technical audit on top of the self-assessment questionnaire — and most businesses that fail do so on patching, MFA gaps, or unencrypted devices that nobody flagged before the assessor showed up.
Why this matters
Cyber Essentials Plus is the version buyers actually trust. The base Cyber Essentials certificate is self-declared — you fill in a questionnaire and sign it. Plus means an independent assessor tests your systems: external vulnerability scans, internal device sampling, and sometimes a phishing simulation.
Failing the audit isn't rare. Assessors commonly flag missing patches, weak MFA enforcement, and devices with local admin rights nobody remembered to lock down. None of that is complicated to fix. It's just easy to forget when nobody owns the checklist.
Getting this right in 2026 also opens doors: G-Cloud and NHS framework buyers increasingly require Cyber Essentials Plus, not the base tier, before they'll even shortlist you. Automate compliance certification tracking now and the audit stops being a fire drill.
What you'll need
- A current device inventory — every laptop, server, and mobile device that touches company data, including remote workers' machines
- Patch management records — proof that critical and high-severity patches are applied within 14 days of release
- MFA enabled on all cloud services, admin accounts, and remote access points
- Firewall configuration exports from your router or UTM device, showing default passwords changed and unnecessary ports closed
- An external vulnerability scan completed in the last 30 days — most certification bodies require this before booking the audit, and a scan from a firm like those covered in this penetration testing companies comparison satisfies that requirement
- 2-3 hours of assessor access, either remote screen-share or on-site, depending on your certification body
The steps
1. Run an asset inventory audit
List every device with access to company systems — including BYOD phones with email access. Assessors sample a percentage of your device fleet, and an incomplete inventory is an automatic red flag.
Mistake to avoid: forgetting shared devices in reception areas or warehouse floors. Those count too.
2. Patch everything within the 14-day window
Cyber Essentials Plus requires all critical and high-severity vulnerabilities patched within 14 days of the vendor release. Check every OS, browser, and third-party application — not just Windows Update.
Run a scan against your patch baseline this week. If you're managing patches across a distributed team or client base, the process detailed in vulnerability and patch management for MSPs applies whether you're an MSP or an in-house IT lead.
Common mistake: relying on auto-update settings without verifying they actually ran. Pull the patch logs and check dates, not settings screens.
3. Lock down MFA on every account that needs it
MFA must be enforced on cloud services, admin accounts, and any remote access into your network. Assessors will test this directly — they'll try logging into a sampled account without the second factor.
Expected outcome: every admin and cloud login blocks access without the second factor, no exceptions for "convenience" accounts.
4. Remove local admin rights from standard user accounts
Users should not have local admin rights on their own machines unless their role genuinely requires it. This is one of the five Cyber Essentials Plus control areas and one of the easiest to fail if nobody's audited permissions in a year.
Mistake to avoid: leaving admin rights on because "it's always been that way." Assessors sample devices and check this directly.
5. Configure and document your firewall rules
Export your firewall or router configuration. Confirm default admin passwords are changed, unused ports are closed, and rules match documented business need — not leftover settings from a previous IT provider.
6. Commission the external vulnerability scan
Book this 3-4 weeks before your audit date, not the week of. Scans surface issues you'll need time to fix — open ports, expired certificates, outdated software versions exposed to the internet.
7. Brief your staff
Assessors sometimes include a basic phishing or social engineering check. Staff who click a test phishing link or hand over a password over the phone can affect your result. A short briefing closes this gap fast — see security awareness training for remote teams if your team works outside a single office.
Common mistake: assuming a one-off training email from years ago still counts. Assessors want current evidence, not historical intent.
8. Compile your evidence pack
Gather patch logs, MFA screenshots, firewall exports, and the scan report into one folder before the audit. Assessors move faster — and find fewer surprises — when evidence is organised rather than scattered across email threads.
Automate your Cyber Essentials Plus evidence
OneClickComply tracks patch status, MFA, and backups so audit prep stops being manual.
Troubleshooting
- Assessor flags an unpatched device you thought was covered — check if auto-update was silently disabled by a user; this happens more than IT teams expect.
- MFA test fails on one account — service accounts and shared mailboxes are the usual culprits; MFA needs to cover these too, not just named user logins.
- External scan comes back with open ports you didn't expect — a legacy firewall rule from a decommissioned vendor tool is the most common cause; audit rules quarterly, not just before certification.
- Staff fail a phishing simulation — don't treat this as a fail-and-forget; document the retraining and rerun before the actual audit date.
- BYOD devices can't produce patch evidence — either bring them into a mobile device management policy or exclude them from network access entirely; assessors accept either, but not silence on the issue.
- Certification body says your scope is unclear — define exactly which devices, networks, and cloud services are in scope before booking; scope creep mid-audit adds delay and cost.
Tools and resources
- Patch management dashboards that log update dates automatically, not spreadsheets updated by hand
- MFA enforcement policies applied at the identity provider level, not per-application
- A comparison of Cyber Essentials Plus certification bodies if you haven't booked your assessor yet
- Vulnerability scanning tools that produce a dated, exportable report format
- A single evidence repository — screenshots, logs, and configs stored together, not scattered across inboxes
What to do next
Once Cyber Essentials Plus is locked in, most growing UK businesses look at ISO 27001 or SOC 2 next, especially if enterprise buyers are asking for it in procurement. Automating the evidence collection now — patches, MFA, backups — means the next certification builds on what you've already documented instead of starting from zero.
Frequently asked questions
One last thing
The single biggest reason businesses fail Cyber Essentials Plus in 2026 isn't a missing firewall rule — it's a patch that was "applied" three weeks ago but the log says otherwise. Assessors trust dates, not intentions. Keep your evidence current, not just complete, and the audit turns into paperwork instead of a scramble.
Seriously Simple Cyber Compliance means the evidence trail runs itself, so you're never rebuilding it the week before an assessor calls.