Cyber Essentials Plus Explained: What Every London Business Needs to Know

A clear breakdown of the certification, why it matters for tenders, and how to prepare without burning out your team.

What Cyber Essentials Plus actually is

Cyber Essentials is a UK government-backed scheme administered by IASME on behalf of the NCSC. The standard tier is a self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an external assessor, who validates your controls against a sample of your devices.

For London businesses bidding into the public sector, financial services, or larger corporates, Cyber Essentials Plus is increasingly a non-negotiable line item in supplier questionnaires.

The five technical controls under the microscope

  • Firewalls — boundary and host-based, correctly configured
  • Secure configuration — no default credentials, unused services disabled
  • User access control — least privilege, MFA on admin accounts
  • Malware protection — modern EDR or properly configured AV
  • Security update management — high/critical patches within 14 days

The Plus audit will pick a representative sample of your laptops, servers, and mobile devices and verify each control is actually in place — not just claimed.

What trips most companies up

  • BYOD devices accessing company email without MDM enrolment
  • Old macOS or Windows builds that have fallen out of vendor support
  • Browser plugins and third-party apps missing from the patch cycle
  • Local admin rights granted "temporarily" two years ago

Realistic timeline and cost

Most London SMEs need 4–8 weeks of preparation if starting from scratch. Certification fees scale by company size, typically £1,500–£3,500 for Plus including the assessment. Remediation work — MDM rollout, EDR replacement, patch hygiene — is the variable cost.

How to pass first time

Run a pre-assessment against the IASME question set, fix the gaps, then book the audit. Don't book the audit hoping to discover the gaps. A failed assessment isn't catastrophic, but it costs you a re-test fee and momentum.

Want a hand?

We help London businesses pass Cyber Essentials Plus on the first attempt — including the boring bits like MDM, patching, and evidence collection. Book a free strategy call or chat with us on WhatsApp to see what's involved.