The Cyber Essentials Plus Assessment
Cyber Essentials Plus is the audited level of the scheme. Where the basic certificate rests on your own attested answers, Plus has a licensed assessor test your devices and internet boundary to confirm the five controls actually work. It is the level larger customers and a growing number of public sector buyers ask to see. Negative Zero conducts the assessment as an IASME-licensed Certification Body, and booking to certificate is often three or four days.
Cyber Essentials
You answer the official question set, a board member attests to the answers, and a licensed assessor marks them. A pass with no non-compliances is the prerequisite for Plus.
Cyber Essentials Plus
An assessor tests a sample of your devices and your internet-facing systems hands-on: patch levels, malware protection, multi-factor authentication and account separation. Plus must be completed within three months of your basic pass.
What the Assessor Tests
External Vulnerability Scan
Your internet-facing IP addresses are scanned. Any high or critical vulnerability with a fix more than 14 days old is a fail, the same 14-day rule the basic assessment applies.
Authenticated Device Checks
A sample of your workstations, laptops and mobile devices is checked for operating system and software patch levels and secure configuration.
Malware Protection Tests
Test files are sent by email and downloaded through the browser to confirm your devices block or quarantine them.
Account and MFA Checks
Cloud services are checked for multi-factor authentication, and devices for separation of admin and standard user accounts.
Before We Book the Assessment
If something fails on the day, remediation is included in your price and we retest once it is fixed. The only extra cost is if the work runs past the three-month window from your basic pass, so we would rather find every issue before the assessment is booked.
The readiness check runs the same tests as the assessment, across your devices and cloud configuration, and shows you exactly what would fail. It does not change the bar. It means you reach it prepared.
Assessment Readiness Check
Run the Negative Zero Agent across your devices and cloud configuration before we book the assessment, so nothing on the day comes as a surprise.