Cyber Essentials PLUS Guided

A guided route if you want structured support across both the CE and CE+ assessments.  This offering includes all the benefits of the Cyber Essentials Guided offering, together with additional preparation ahead of the official CE+ assessment.
‍
This offering includes Cyber Essentials Guided, a Vulnerability Check Workshop, the formal CE+ assessment, and 1 included follow-up test within the NCSC remediation window, in line with the Danzell scheme’s remediation process.  Your assessor will also help to validate the proposed certification scope and complete the Technical Scope Verification activities required ahead of the CE+ assessment.  This helps ensure the scope is appropriate and any potential issues are identified as early as possible.
‍
This offering does not include access to the Abriska CE+ Assured module, which provides vulnerability scanning and compliance assurance services both ahead of and after the CE+ assessment.  Organisations selecting Cyber Essentials PLUS Guided should therefore already have an established vulnerability scanning capability and mature patch management processes.  If you do not have these capabilities, Cyber Essentials PLUS Assured will provide the most appropriate level of support.

Vulnerability Check Workshop

The internal authenticated vulnerability scan is the single most common reason for failing a CE+ assessment, and under new Danzell requirements, multiple vulnerability reports are no longer acceptable.
‍
To help reduce the risk of assessment failure, Cyber Essentials PLUS Guided includes a vulnerability check workshop ahead of the official CE+ assessment.  The workshop is designed to provide visibility of vulnerabilities that could result in a failed assessment, helping you address issues before testing takes place and improve your chances of first-time success.
‍
If your organisation already has a vulnerability scanning solution, we will ask you to perform a scan prior to the workshop and review the results with one of our assessors.  Where a scanning capability is not available, URM can provide Qualys agents for installation on applicable devices and conduct the scan on your behalf.  Please note that only devices with an installed agent can be assessed.
‍
During the workshop, your assessor will review the scan findings, highlight any vulnerabilities that could prevent a successful CE+ assessment, and provide guidance on the remediation actions required before testing begins.   All detections should be remediated before the CE+ assessment.
‍
The workshop provides a point-in-time assessment of your vulnerability status; organisations remain responsible for ensuring compliance is maintained between the workshop and the formal CE+ assessment, and following certification. If you do not have an established vulnerability scanning capability and mature patch management processes, Cyber Essentials PLUS Assured remains our recommended option.

Scope Verification and Technical Scope Verification (TSV)

In most cases, the Technical Scope Verification is conducted separately from the CE+ assessment and must be passed at least 7 working days before the assessment start date.  For this Cyber Essentials PLUS Guided offering, the TSV will typically be conducted as part of a scope verification workshop.  During the workshop, your assessor will review the proposed certification scope with you to help ensure that it accurately reflects your organisation, is suitable for CE+, and does not contain issues that could prevent the assessment from proceeding.
‍
This approach significantly reduces the risk of booking CE+ assessment time that cannot be used if issues are later identified with the declared CE scope.  Any factors that could prevent a successful CE+ assessment are identified and addressed early in the process.
‍
For some small or micro-organisations (e.g., where the whole organisation is in scope and only a very small number of devices are involved) it may be possible to agree that the TSV is performed at the start of the CE+ assessment rather than as a separate activity in advance.*
‍
* Performing the TSV on the day of the CE+ assessment may reduce cost and administrative effort, but it increases risk. If issues are identified that cannot be immediately resolved, the CE+ assessment time will need to be either repositioned as advisory activity or postponed, and postponement charges will apply. By choosing this option, you acknowledge that passing the TSV is a prerequisite for proceeding with the formal CE+ assessment and that this approach carries a higher risk.

Follow-up Testing

If the TSV passes successfully, but the CE+ assessment identifies failing items, you may book 1 follow-up test in line with NCSC guidance and the Danzell remediation process.  A second sample set must be selected for this test.  If the same vulnerabilities are identified again, you will fail the CE+ assessment and your CE certificate will be revoked in accordance with scheme rules.
‍
To reduce this risk and achieve the smoothest possible path to CE and CE+ certification, you may wish to consider the Cyber Essentials PLUS Assured offering, which includes additional scanning, advisory support, and assurance designed to identify and resolve issues earlier.

‍

‍

Why URM?

As an accredited certification body, URM has an unrivalled record in assisting organisations of all sizes achieve certification to Cyber Essentials and Cyber Essentials Plus. URM is also an accredited Assured Service Provider under the NCSC Cyber Advisor scheme  and  has a large team of experienced, pragmatic assessors who are here to support you and guide you through the process.

Not only do we bring a wealth of cyber security knowledge, but also a wide and varied experience of all the leading cyber and information security standards.

As such, you can be assured that you are getting advice that is right for you and your organisation, taking into account your sector, size and the information you are looking to protect. Our large team of assessors also enables us to guarantee a super-fast turnaround.

‍