Complete checkbox checklist of all Cyber Essentials Plus requirements organised by the five control areas, with evidence needed and pass/fail criteria for each item.
The Cyber Essentials Plus examination assesses your organisation against specific technical requirements across five control areas. This checklist breaks down every requirement into actionable checkbox items so you can systematically work through each one, document your evidence, and track your progress toward certification. Each item includes the specific requirement, what evidence the assessor will look for, and the pass/fail criteria. Use this as your master tracking document throughout the preparation process to ensure nothing is missed before examination day.
IT teams and compliance officers who need a structured, trackable checklist to systematically prepare for and verify readiness for Cyber Essentials Plus examination.
Assessors typically want to see firewall configuration exports, a current asset inventory, patch status reports, screenshots of MFA settings, and antivirus deployment records. Evidence should reflect your actual environment at the time of examination, not a point-in-time snapshot from months earlier, since assessors often test live.
Basic Cyber Essentials relies on a self-assessed questionnaire, while Plus adds an independent technical audit including vulnerability scanning and on-site or remote testing of devices. Plus is generally required for government contracts involving sensitive data and gives clients stronger assurance that controls are actually implemented, not just declared.
Certification requires every in-scope device to meet all five control requirements with no critical or high-severity vulnerabilities left unpatched. A single unpatched critical vulnerability on an in-scope device can result in a fail, so organisations typically need a clean sweep across all sampled devices, not just a majority.
Yes, this checklist is designed as a shared tracking document with checkbox items, evidence fields, and a scoring system so IT teams and compliance officers can divide work by control area and monitor overall readiness before booking the examination.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
23 Oct, 2026
A working VoIP CRM integration connects your phone system to the software where your customer and support records live, so that calls arrive with context and...
22 Oct, 2026
Fixed wireless access delivers business internet over radio rather than a cable into the building, and for many UK businesses it is a genuine primary...
21 Oct, 2026
Row-level security reporting means building dashboards that show each person only the rows of data they are entitled to see their own region, their own team,...