Compliance
Cyber Essentials Plus: what the audit actually checks
The self-assessment gets you the basic certificate. Plus adds a hands-on technical audit, and the failures are predictable.
The difference in one line
Cyber Essentials is a self-assessment questionnaire, verified on paper. Cyber Essentials Plus is the same five control areas with an independent assessor testing a sample of your actual devices. The requirements do not change. The verification does.
Where organisations fail the Plus audit
Patch age on a sampled device
High and critical patches must be applied within fourteen days. The device that fails is almost always a laptop belonging to someone who has been travelling, or a machine that has been off.
Unsupported software still installed
An end-of-life runtime, an old browser, a version of a tool nobody uses. The assessor finds it because they look at the whole installed list, not the one you maintain.
Malware protection not actually running
Configured centrally, disabled locally, nobody alerted. Enforcing this through Intune compliance rather than assuming it is the fix.
Multi-factor authentication gaps on cloud services
Enforced for staff, missing on a service account or an administrator that was excluded during a project and never re-included.
Run the sample yourself first
Pick five devices at random, including one belonging to someone who works remotely and rarely comes in. Check patch age, installed software and malware protection status on each. That exercise predicts the audit result more accurately than any readiness questionnaire.
The verdict
Go for Plus if a contract asks for it, and only then
It is meaningfully more credible than the self-assessment because somebody independent verified it. It is also more work, and basic Cyber Essentials satisfies most requirements.
Do not book the Plus audit until you have run your own device sample. A failed audit costs a re-test fee and a delay you cannot explain to the customer who asked.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.