Cyber Essentials Plus Certification

Conditions

Cyber Essentials Plus involves a technical audit of the systems that are in scope for Cyber Essentials. This includes a representative set of end-user devices – workstations and laptops, mobile devices, internal- and external-facing servers, hypervisors, thin clients, BYOD (bring your own device) and other build types used by the organisation. The number of builds is defined by the number of configurations of operating systems such as type, version, edition, etc. If more than one browser or Office suite is used on the end-user devices, each variant will need to be tested for browser downloads and email downloads tests. All end-user workstation and laptop devices will be tested for account separation. All Cloud services in scope for Cyber Essentials will also be tested for MFA (multifactor authentication) or SSO (single sign-on) capabilities where available.

• This package includes a Cyber Essentials Plus audit at one location on up to ten sample devices. Additional end-user devices – workstations and laptops, mobile devices, internal- and external-facing servers, hypervisors, thin clients, BYOD and other build types used by the organisation – may need to be tested to meet the sampling requirements of the scheme. If you require more than ten devices to be tested, you will need to purchase Cyber Essentials Plus Certification – Additional Device Testing. This testing can be conducted remotely in most instances.
• If you fail any of the Cyber Essentials Plus testing performed as part of the overall engagement, we will provide you with details of further tests required. Cyber Essentials Plus final reports must be completed no more than 30 days after the start date of the first scans. Any remediation work and required retesting must be completed with sufficient time for QA and generation of the report and certificate within this time frame. These tests will be billed separately.
• The package includes an external vulnerability scan for up to 16 IP addresses. If you have more than 16 IP addresses, you will need to purchase additional IP packages in packs of 16. If you fail your external scan, a rescan will need to be purchased, plus any additional IP packages that you need to cover the failing IP addresses if you have more than 16 IP addresses.
• If you ask that testing is undertaken at your business location, additional expenses will be charged to accommodate our consultant’s travel time and costs for the on-site assessment. These will be billed separately.
• If your Cyber Essentials Plus application is unsuccessful, your Cyber Essentials certification may be revoked.
• If your Cyber Essentials Plus application is not fully complete within three months from the date of your Cyber Essentials certificate, you will need to repeat your Cyber Essentials certification at full cost.

Pre-test requirements

• All devices are subject to testing and will be agreed upon before the testing date, including end-user devices – workstations and laptops, mobile devices, internal- and external-facing servers, hypervisors, thin clients, BYOD and other build types used by the organisation – and must be available for testing on the agreed date/during the engagement.
• All devices within the scope of testing must be devices in use on a day-to-day basis and cannot be built specifically for testing. The same applies for user accounts tested on these devices.
• Devices must have Internet access, and allow email downloads and browser downloads tests for standard user accounts on end-user devices – workstations and laptops, mobile devices, internal- and external-facing servers, hypervisors, thin clients, BYOD and other build types.
• All end-user computer devices will be tested for account separation and must only be on a standard user account and must not have local admin privileges.
• Cloud services in scope for Cyber Essentials will be tested for MFA or SSO if the service provider supports either functionality.
• An external vulnerability scan will be required for all external-facing assets in scope of Cyber Essentials such as external-facing servers, firewalls, routers, IaaS (Infrastructure as a Service) Cloud, websites, etc. that are hosted or managed by the organisation.
• An internal vulnerability scan will be required for each sample device in scope of Cyber Essentials including end-user devices – workstations and laptops, mobile devices, servers, hypervisors, thin clients, BYOD and other build types used by the organisation.
• Internal and external vulnerability scans will be conducted using Qualys Cloud agents. If you require delivery using an alternative method, please discuss this with us at the time of your booking.
  • Qualys Cloud agents: The agents must be installed on the sample set of devices selected for the assessment after the pre-engagement call.