What Cyber Essentials Plus Means: A 2026 Guide

Table of Contents

• What Cyber Essentials Plus Means
• Cyber Essentials vs Cyber Essentials Plus: Key Differences
• Cyber Essentials Plus Requirements: The Five Technical Controls
  • Firewalls and network segmentation
  • Secure configuration and patch management
  • Access control and user management
  • Malware protection
  • Removable media and data handling
• What a Cyber Essentials Plus Assessment Involves
• Preparing for a Cyber Essentials Plus Audit
• Why Cyber Essentials Plus Matters for Your Business
• Getting Cyber Essentials Plus Certified
• Frequently Asked Questions

Last Updated: 19 October 2026

What Cyber Essentials Plus Means

Cyber Essentials Plus is a government-backed certification demonstrating your business has implemented strong technical security controls against common cyber threats. Unlike basic Cyber Essentials, it includes an independent third-party assessment of your security infrastructure, not just a self-assessment questionnaire (Cyber Essentials).

The certification covers five core technical areas: firewalls, secure configuration, access control, malware protection, and removable media handling. For businesses in Harrogate and across the region, achieving Cyber Essentials Plus certification signals to customers, partners, and insurers that you take cybersecurity seriously.

At Hamilton Group, we help Yorkshire businesses understand what Cyber Essentials Plus means in practice. Many assume it's overkill; in reality it's a baseline framework that prevents most opportunistic attacks, like fitting a proper alarm and reinforced locks.

The assessment is thorough but manageable: a qualified assessor reviews your systems and verifies your controls are genuinely in place. For a 15-staff charity or growing tech firm, certification can offer significant benefits.

Cyber Essentials vs Cyber Essentials Plus: Key Differences

The distinction comes down to verification and depth. Standard Cyber Essentials relies on self-assessment: a questionnaire with no independent verification, assessor visit, or technical testing.

Cyber Essentials Plus involves an independent assessor conducting a hands-on technical audit: testing firewall rules, examining patch logs, verifying access controls, and checking malware protection across all endpoints. This third-party verification carries far more weight with customers and insurers, and many procurement teams now specifically require Cyber Essentials Plus.

The cost difference is modest. Standard Cyber Essentials is free to pursue (though many pay for support completing the questionnaire). Cyber Essentials Plus requires an accredited assessment body, with pricing depending on the size and complexity of the organisation.

Cyber Essentials Plus certification is valid for three years, with reassessment needed to maintain it. Standard Cyber Essentials has no formal reassessment requirement, though answers become outdated within 12-18 months anyway.

Cyber Essentials Plus Requirements: The Five Technical Controls

Achieving Cyber Essentials Plus means demonstrating that five specific technical controls are properly implemented and actively protecting your systems. An assessor verifies each one is genuinely in place and functioning.

Firewalls and network segmentation

Your firewall is the first line of defence between your internal network and the internet. For Cyber Essentials Plus, you must show a firewall is installed, configured with explicit traffic rules, and actively logging suspicious connection attempts.

Network segmentation divides systems into separate zones so a compromise in one area can't spread, keeping guest WiFi separate from the business network, or isolating sensitive servers. For smaller Harrogate organisations under 50 staff, that often means putting financial systems and customer data on a different segment from general office computers.

The assessor will review your firewall configuration and access logs and verify unnecessary ports are closed. Leaving default firewall rules in place is a common control failure, document which traffic you explicitly allow and why.

Secure configuration and patch management

This control ensures every device is configured securely and kept up to date with security patches, simple in principle, but where many organisations stumble.

Secure configuration means disabling unnecessary services, removing default passwords, and hardening operating systems. For Windows devices, apply Microsoft's security baselines; for servers, remove unnecessary software and tighten permissions. Assessors spot outdated systems, missing critical patches, and weak settings.

Patch management is ongoing: install standard patches within 30 days and critical security updates immediately. Many Yorkshire organisations have fallen victim to ransomware exploiting known vulnerabilities in unpatched software. Cyber Essentials Plus requires evidence of a patch management process and that systems are current.

The assessor will scan for known vulnerabilities and check your patch history; critical updates months out of date mean failure. A documented patch schedule and evidence of compliance are essential.

Access control and user management

This control ensures only authorised people can access your systems and data, and only what they need for their role.

Access control starts with strong authentication: every account needs a strong, unique password, or better, multi-factor authentication (MFA) with a second factor like a phone code.

User management means keeping your directory clean: revoke access immediately when someone leaves and update permissions when roles change. A common finding is former employees with active accounts or staff with excessive permissions from previous roles. Demonstrate that you regularly review access and have a process for removing it.

For Microsoft 365 or other cloud services, ensure shared mailboxes, document libraries, and other resources have appropriate permissions. The assessor verifies your controls actually prevent unauthorised access, not just that a policy exists.

Malware protection

Every device on your network needs active malware protection: antivirus on all Windows computers, endpoint detection and response (EDR) on critical servers, and email filtering to block malicious attachments and phishing links.

Malware protection isn't one-time: definitions need daily updates. Many organisations disable it for performance or let licences lapse. The assessor will verify it's installed, enabled, and current on every device.

Email filtering matters most: most ransomware and phishing arrives via email. A proper filter scans inbound messages for malicious attachments, blocks suspicious senders, and flags impersonation attempts. Without filtering, you're leaving the front door wide open.

For Harrogate organisations running their own email servers, this is critical. Cloud services like Microsoft 365 include built-in filtering, but ensure it's configured properly rather than left on defaults.

Removable media and data handling

This control covers portable devices, USB drives, external hard drives, CDs, and how you dispose of old equipment containing sensitive data.

The risk is straightforward: a USB drive holding customer data or financial records could be lost, stolen, or plugged into a compromised computer. Your policy should restrict removable media entirely or encrypt it so lost drives are unreadable without a password.

Data handling also means securely wiping old computers and drives, deleting files isn't enough, as deleted data can be recovered. Use proper data destruction methods or a certified destruction service.

For remote workers this control is especially important: staff at home may use personal USB drives, download files to personal devices, or work on unsecured networks. Your policy must address these scenarios so sensitive data stays protected outside the office.

Get Started Today →

What a Cyber Essentials Plus Assessment Involves

It typically begins with a scoping meeting covering your organisation's size, infrastructure, systems to protect, current security practices, and recent changes, helping the assessor understand what to examine during the technical phase.

The technical phase involves direct examination: vulnerability scans for missing patches and weak configurations, review of firewall rules and access controls, verification of malware protection, and checks of patch management logs.

The assessor also reviews documentation and policies, looking for evidence of formal processes for patching, access control, removable media, and incident response.

Afterwards the assessor produces a detailed report.

Preparing for a Cyber Essentials Plus Audit

Preparation is the difference between a smooth assessment and discovering critical gaps mid-audit. Start four to six weeks before your scheduled assessment to fix issues without rushing.

Create a spreadsheet listing every device, workstations, servers, printers, network equipment, with OS version, patch level, and antivirus status.

For patch management, review your process: is there a scheduled maintenance window, and are critical patches applied within 30 days?

Test your password policy: can staff create weak passwords, or are passwords shared or written down?

For malware protection, verify antivirus is installed on all Windows devices with current definitions, and that email filtering is enabled to block common threats. Update any older software with expired licences.

Document your data handling procedures: how removable media is encrypted or restricted, and how old equipment is disposed of.

Why Cyber Essentials Plus Matters for Your Business

The immediate reason to pursue Cyber Essentials Plus is that many customers and partners now expect it: government contracts often require it, and insurers offer better premiums.

Breaches are expensive: ransomware can shut operations for days or weeks, and data breaches bring fines and reputational damage. For small businesses in Harrogate and across Yorkshire, one serious incident can be existential.

For regulated industries, healthcare, finance, education, Cyber Essentials Plus often helps demonstrate compliance with data protection requirements. It's no substitute for industry-specific standards, but it provides a foundation regulators recognise.

Certification costs are modest against the cost of a breach. Improved insurance terms, avoided downtime, prevented data loss, and customer trust all contribute to a clear business case.

Getting Cyber Essentials Plus Certified

The process starts with choosing an accredited assessment body from the scheme's list of approved assessors, trained and audited for consistent standards.

Most assessors offer a pre-assessment consultation, reviewing your security posture and highlighting obvious gaps to fix before the formal audit, reducing the risk of failing and needing to reassess.

Work with your IT team or external provider to address any gaps identified.

On assessment day the assessor conducts the technical evaluation, reviews policies and documentation, and interviews key staff.

Afterwards you'll receive a detailed report.

Once certified, maintain your controls: the certificate lasts three years, but your security posture must stay current as new vulnerabilities emerge, staff join, and devices are replaced.

Cyber Essentials Plus certification demonstrates that your business takes cybersecurity seriously and has implemented the technical controls that prevent the majority of common attacks.