Cyber Essentials Plus certification proves, with an independent technical audit, that your business is properly protected against common cyber attacks. Cloudswitched prepares UK businesses — remotely, with London on-site coverage — for a smooth first-time pass and manages renewal every year after.
We run a full gap analysis against the five Cyber Essentials Plus requirements before your assessment date, fixing issues in advance rather than finding out on the day.
Our process follows the current IASME-administered Cyber Essentials Plus methodology, so your certification stands up to procurement checks and client due diligence.
Certification lapses without annual renewal. We track your renewal date and keep your environment compliant between assessments, not just on the day of the audit.
Cyber Essentials is a UK government-backed scheme, administered by IASME on behalf of the National Cyber Security Centre, that verifies a business has basic technical controls in place against common cyber attacks. Cyber Essentials Plus builds on the same five control areas, but replaces the self-assessment questionnaire with an independent, hands-on technical audit — including vulnerability scanning and, in most cases, on-site or remote testing of a sample of your devices. Many clients, suppliers and public-sector contracts specifically ask for Cyber Essentials Plus rather than the basic certificate, because the independent verification carries more weight. Whether you're based in London, Birmingham or anywhere else in the UK, the requirements and assessment process are the same nationwide. The scheme sits alongside wider good practice such as staff awareness training, regular backups and a documented incident response plan, but the certification itself is specifically scoped to the five technical control areas assessed on the day.
The Cyber Essentials Plus requirements are built around five technical control areas: firewalls and internet gateways, secure configuration, user access control, malware protection, and security update (patch) management. For Cyber Essentials Plus specifically, an independent assessor verifies these controls are actually implemented and working — not just documented — through vulnerability scanning of your externally facing systems and internal testing of a representative sample of your devices, including laptops, servers and mobile devices where relevant.
Firewalls must be correctly configured on every device and boundary. Software and devices must be securely configured, removing unnecessary accounts and services. Access to accounts and admin privileges must be properly controlled. Anti-malware protection must be active and up to date across the estate. Security patches must be applied within the scheme's required timeframes, particularly for critical and high-risk updates.
The Cyber Essentials Plus assessment typically involves an external vulnerability scan of your internet-facing systems, followed by internal testing carried out either remotely or on-site, checking patch levels, malware protection and configuration on a sample of your devices. You'll need valid Cyber Essentials (basic) certification, achieved no more than three months before your Cyber Essentials Plus assessment, as a prerequisite.
Before booking your assessment, we review your current setup against every Cyber Essentials Plus requirement, identifying gaps in patching, configuration and access control while there's still time to fix them.
We don't just report problems — as part of our managed IT service, we fix firewall rules, apply missing patches, tighten access controls and get malware protection current, so your assessment day goes smoothly.
From initial gap analysis to certified pass and ongoing renewal — our process keeps things simple.
We assess your current setup against every Cyber Essentials Plus requirement and flag exactly what needs attention.
We fix configuration, patching and access control gaps, so you go into assessment with confidence rather than guesswork.
The independent assessor carries out the external scan and internal testing required for Cyber Essentials Plus certification.
You receive your certificate, and we track your renewal date so certification never lapses unnoticed.
We prepare businesses for Cyber Essentials Plus as part of our everyday managed IT support work, so we're fixing the same firewalls, patch levels and access controls we already look after — not learning your environment from scratch for an audit.
Our gap analysis identifies issues in advance of the assessment date, so remediation happens on your timeline, not under pressure during the audit itself.
We manage the full cycle, from your initial Cyber Essentials (basic) certificate through to Cyber Essentials Plus assessment and annual renewal, so nothing lapses unnoticed.
We work with businesses across the whole of the UK — London, Birmingham and everywhere in between — with the same remote-first delivery model and London on-site coverage where it's genuinely useful.
Because Cyber Essentials Plus sits alongside our EDR endpoint protection, 24/7 monitoring and cloud backup services, your certification is backed by controls we actively maintain, not a one-off checklist exercise.
Cyber Essentials Plus assessment fees are set by the certification body and vary by organisation size and device count, while the amount of remediation work needed depends entirely on your starting point — a business already on a managed IT plan typically needs far less preparation than one starting from scratch. Rather than quote a generic figure that may not reflect your environment, we assess your current setup first and provide a clear, fixed quote for gap analysis, remediation and assessment support before any work begins. Businesses already on one of our managed IT support plans generally need less remediation work, since patching, endpoint protection and access control are already maintained as part of the service — the certification process then largely confirms what's already in place rather than starting from a blank slate. For businesses coming to us cold, we'll always be upfront about how much preparation work is realistically needed before you commit to an assessment date.
Cyber Essentials Plus is increasingly requested rather than optional across several sectors.
Many government contracts and public-sector tenders require Cyber Essentials Plus as a condition of bidding, particularly where supplier systems handle official data.
Larger clients increasingly push Cyber Essentials Plus requirements down their supply chain, so smaller suppliers are asked to certify even where it isn't legally mandated.
Businesses handling sensitive client data, or seeking better cyber insurance terms, often use Cyber Essentials Plus to demonstrate independently verified security controls.
Certification is only useful if the controls behind it hold up day to day. Here's what sets our approach apart.
Our EDR endpoint protection, 24/7 monitoring and patch management are already part of our managed IT service — the same controls a Cyber Essentials Plus assessor is checking for.
We support Cyber Essentials Plus certification for businesses across the UK, including London and Birmingham, with remote-first delivery and on-site cover in London.
We identify shortfalls against every requirement before your assessment date is booked, so surprises are found and fixed early, not on assessment day.
We monitor your certification anniversary and start preparation early, so Cyber Essentials renewal never becomes an unplanned scramble.
You deal with one named contact throughout gap analysis, remediation and assessment, rather than being passed between departments.
We don't hand you a list of problems and walk away — our engineers fix firewall rules, patch systems and tighten access controls directly.
Cyber Essentials Plus preparation sits alongside our regular managed IT support, so controls stay maintained long after the certificate is issued.
Our 24/7 monitoring and EDR endpoint protection continue working between assessments, catching issues long before a renewal audit would.
You'll get a clear, fixed quote for gap analysis, remediation and assessment support once we understand your starting point — no vague hourly billing.
Achieving Cyber Essentials Plus certification depends on the underlying infrastructure being properly configured — firewalls, endpoint protection, patch management and access controls all need to work together, not just exist on paper. Businesses relying on cloud email, Azure cloud servers or Cisco Meraki cloud networking need these controls applied consistently across every device and connection point. Managed IT support that maintains these systems day to day makes both the initial certification and every subsequent renewal considerably more straightforward.
Cyber Essentials (basic) is a self-assessment questionnaire, verified by an external body but not independently tested — it confirms you understand and have documented the five controls. Cyber Essentials Plus goes further, with an independent technical audit including vulnerability scanning and device testing to verify the controls actually work in practice.
Choose basic Cyber Essentials if: you need a recognised baseline certificate quickly, your clients or contracts don't specifically require the higher tier, and you want the lower-friction starting point before working towards Plus.
Choose Cyber Essentials Plus if: a client, tender or insurer specifically asks for it, you want independently verified assurance rather than a self-assessment, or you're pursuing public-sector or government-adjacent contracts where the higher tier is often expected.
Renewal: both certifications require annual renewal — Cyber Essentials Plus certification cannot be more than three months older than its underlying Cyber Essentials certificate, so the two renewal cycles need to be planned together rather than treated as separate events.
Cost of getting it wrong: businesses that leave preparation until close to a tender deadline often find gaps that take weeks to fix properly, from outstanding patches across an estate to accounts that were never properly deprovisioned. Starting gap analysis early, well before a client or contract deadline, avoids the scramble and the risk of a failed first assessment.
Quick Verdict
If a client, tender or insurer requires independently verified security controls rather than a self-declared checklist, Cyber Essentials Plus certification is the tier to pursue — and the sooner gap analysis starts, the smoother the assessment.
cyber essentials plus certification
A UK government-backed certification, verified through independent technical audit, confirming a business has effective controls against common cyber attacks across firewalls, configuration, access, malware protection and patching.
cyber essentials plus assessment
The independent testing stage of certification, combining an external vulnerability scan with internal device testing carried out remotely or on-site by a qualified assessor.
Got questions? We've answered the most common ones below. If you need more detail, get in touch.
Cyber Essentials (basic) is a self-assessment questionnaire verified externally but not independently tested. Cyber Essentials Plus adds an independent technical audit, including a vulnerability scan and internal device testing, to verify the same five controls are genuinely working.
The requirements cover five control areas — firewalls and internet gateways, secure configuration, user access control, malware protection and security update management — all verified through independent testing rather than self-declaration.
The technical audit itself is often completed within a day for a small or medium business, though the preparation beforehand — gap analysis and remediation — typically takes longer and depends on your starting point.
Only if a client, tender, insurer or your own risk appetite calls for independently verified assurance. Many businesses hold basic Cyber Essentials for years before a specific contract requirement pushes them towards Cyber Essentials Plus.
Both Cyber Essentials and Cyber Essentials Plus need renewing annually. We track your renewal date and start preparation early so the process is straightforward rather than a last-minute rush.
Yes, we support businesses across the whole of the UK, including London and Birmingham, through the same remote-first delivery model, with London on-site coverage available where needed.
An independent assessor runs an external vulnerability scan against your internet-facing systems and internal tests against a representative sample of your devices, checking patch levels, configuration, malware protection and access control.
This is exactly why we run a gap analysis beforehand — to catch and fix issues before the formal assessment. If a retest is ever needed, we work through the findings and support you to a successful reassessment.
Many government and public-sector tenders specifically require Cyber Essentials Plus rather than the basic certificate, particularly where your systems will handle official data. Check the individual tender requirements, but it's increasingly the default expectation.
Yes. As a Cyber Essentials Plus provider working across the UK, we support businesses nationwide through the same remote-first process, with the option of on-site coverage in London.
Limited time offer — valid until 31/05/2026
We believe that communication is key to any successful partnership. Submit your details and one of our friendly team members will be in touch with you shortly.
Submit your details and one of our friendly team members will be in touch with you shortly
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
23 Aug, 2026
AI code review has moved from novelty to default in UK development teams inside about eighteen months. Pull requests now arrive pre-annotated by a model,...
22 Aug, 2026
Google Ads wasted spend is the single most recoverable line item in most UK SME marketing budgets. It is not a strategy problem and it is rarely a creative...
21 Aug, 2026
Cyber Essentials certification has quietly become a commercial requirement rather than a security badge. It is mandatory for most central government contracts...