Cyber Essentials Plus Auditing

Cyber Essentials Plus is the audited route for organisations that need stronger assurance than standard Cyber Essentials alone. Punk Security provides the audit itself, independently testing the in-scope environment to verify that the scheme controls are really operating in practice.

What Cyber Essentials Plus is

Cyber Essentials Plus is the higher-assurance route built on top of Cyber Essentials. IASME describes it as a technical audit of your IT systems that verifies the Cyber Essentials controls are in place.

The verified Cyber Essentials self-assessment is a prerequisite to Cyber Essentials Plus. The Plus audit then tests the environment to provide greater confidence that the organisation is genuinely meeting the scheme requirements.

This page is for the audit

This service is for organisations that want to book the Cyber Essentials Plus audit itself.

It is not positioned as a readiness engagement. The focus is on:

• confirming the audit scope
• planning the audit activity
• performing the technical verification required by the scheme
• reporting the outcome of the audit

Who this is for

• You have been asked for Cyber Essentials Plus rather than standard Cyber Essentials.
• You need independent technical verification for customers, procurement, or supply-chain requirements.
• You want a stronger assurance statement than the verified self-assessment route alone.
• You already hold, or are completing, Cyber Essentials and want to progress to the audited route.
• You need an audit of the in-scope environment rather than advisory preparation work.

What the audit covers

Cyber Essentials Plus is still based on the same five technical control areas:

1. Firewalls
2. Secure configuration
3. Security update management
4. User access control
5. Malware protection

IASME states that the audit covers a representative set of user devices, all internet gateways, and all servers with services accessible to the internet.

What Punk Security does as part of the audit

• Confirm the scope and audit assumptions.
• Review the prerequisite Cyber Essentials position.
• Plan the technical audit activity against the in-scope estate.
• Perform the verification testing required by the scheme.
• Record findings and determine whether the audited environment meets the standard.

What you need before booking

• A completed or in-progress Cyber Essentials assessment.
• A clear scope for the estate being audited.
• Access to the in-scope devices, systems, gateways, and supporting contacts needed for the audit.
• Confidence that the environment presented for audit matches the environment declared in the Cyber Essentials submission.

What usually affects the audit

• Inconsistent patching across sampled devices.
• MFA that is partially deployed but not consistently enforced.
• Older devices or exceptions still sitting inside the audit scope.
• Shared platforms, third-party IT support, or unclear ownership of internet-facing services.
• Differences between the stated scope and the environment actually presented for testing.

Typical audit route

1. Complete Cyber Essentials first.
2. Confirm the Cyber Essentials Plus scope and logistics.
3. Arrange the audit activity.
4. Perform the technical verification testing.
5. Record the outcome and complete the certification process where the standard is met.

Why Punk Security

• We provide the technical audit itself, not just generic scheme commentary.
• We understand how the scheme behaves in real estates with cloud services, endpoints, identity systems, and operational constraints.
• We keep the audit route clear for the customer team, including what is being tested and why.
• We can support wider assurance journeys afterwards, but the primary service here is the audit.

Common questions

Do we need Cyber Essentials before Cyber Essentials Plus?

Yes. IASME describes the verified Cyber Essentials self-assessment as a prerequisite to Cyber Essentials Plus.

Is Cyber Essentials Plus a fixed-price service?

Not usually. IASME positions Cyber Essentials Plus pricing around the size and complexity of the network being audited.

Does Cyber Essentials Plus test every device?

No. It uses representative technical testing, but it still relies on the organisation presenting an environment that is consistently managed across the in-scope estate.

What if we want help getting ready first?

That is a separate conversation from the audit itself. This page is specifically for the Cyber Essentials Plus audit route.

Useful references

• IASME Cyber Essentials overview
• Cyber Essentials Certification
• IASME Cyber Assurance Auditing