Skip to content

Cyber Essentials Plus — Customer Guide

Last updated: 2026-05-15 (Plan 137 v1)

What is Cyber Essentials Plus, and why does it matter to you?

Cyber Essentials Plus is the UK government-backed cyber security certification. It is required for many UK government supplier contracts — especially those handling personal data or sensitive information — and is widely referenced in UK private-sector RFPs across financial services, NHS supply chain and defence prime supply chain. The "Plus" tier adds an independent IASME-registered assessor visit on top of the basic self-assessment, with technical verification against your live setup. The certificate has an annual renewal cycle. The quickest way to take pressure off your team is to keep a continuous audit trail across the five control families so you walk into the assessor visit with a current evidence pack, not a scramble.

What Cyber Essentials Plus-specific features does Secruna ship?

End-to-end (Plan 137) — every item below is wired in the deployed system:

  • Rule book v1 — 18 IGP YAMLs at rule_book/cyber_essentials_plus/v1/ covering the five Cyber Essentials Plus control families: Firewalls and internet gateways (FW.01-03), Secure configuration (SC.01-04), User access control (UAC.01-04), Malware protection (MP.01-03), Security update management (SU.01-04). Loader picks it up via KNOWN_FRAMEWORKS["cyber_essentials_plus"] in packages/rekognise-core/src/rekognise/agent/rule_book/registry.py.
  • Evidence pack export — PDF / CSV / HTML at /exports/cyber-essentials-plus-evidence-pack. Backend renderer in packages/rekognise-core/src/rekognise/cp/export/regulation_evidence_pack.py (shared with NCSC CAF / NIS2 / DORA); API at GET /export/cyber-essentials-plus-evidence-pack?format={pdf,csv,html} mounted by apps/cp-api/src/cp_api/main.py.
  • Tenant subscription — platform admins enable cyber_essentials_plus per tenant via enabled_frameworks (the same Plan 103 path used for every other framework). The evidence-pack endpoint gates on require_framework_subscription(db, tenant.id, "cyber_essentials_plus").
  • Sidebar entry — /exports/cyber-essentials-plus-evidence-pack is registered in the framework feature manifest (packages/rekognise-core/src/rekognise/cp/framework_features/manifest.py) as the cyber_essentials_plus_evidence_pack feature. The Plan 109 dynamic sidebar surfaces the entry automatically when a tenant has cyber_essentials_plus enabled.
  • Counsel review (Plan 97) — every rule YAML carries pending_counsel_review: true so verdicts route through the same counsel pipeline as DS 05-138 / NCSC CAF / NIS2 / DORA rules.
  • Cross-framework signal share — Cyber Essentials Plus reuses the same tenant_cyber_posture artifact-metadata kind that powers DS 05-138 / NCSC CAF / NIS2 / DORA. No new connector signals required for v1.
  • Verdict taxonomy — Fail / Partial Pass / Pass / Not Applicable. See FRAMEWORK_CATEGORY_TAXONOMY["cyber_essentials_plus"] in packages/rekognise-core/src/rekognise/agent/rule_book/loader.py.
  • Operator surface — /admin/regulations lists Cyber Essentials Plus under shipped frameworks; /admin/tenants/{id}/framework-subscriptions accepts cyber_essentials_plus as a subscription target.
  • Audit event — successful exports emit evidence_pack.cyber_essentials_plus.exported for the audit log.

Limitations (v1)

  • No on-premise endpoint posture coverage. Secruna's discovery surface covers cloud workloads (AWS / Azure / GCP / M365 / GitHub / Databricks / etc.) but does NOT include an on-premise endpoint inventory agent. For the Cyber Essentials Plus controls that need per-endpoint evidence (MP.01 anti-malware on user devices, SU.01-04 patching cadence on user devices), the operator must self-attest endpoint coverage until the on-prem agent ships. The on-prem endpoint posture agent is scaffolded under Plan 139.
  • Independent assessor visit is out of scope. Secruna provides the evidence pack and a continuous audit trail across the five control families. The IASME-registered assessor must run the technical verification (random-sample workstation checks, vulnerability scan, MFA enforcement test) at the visit — Secruna does not run the assessor's procedure.
  • Application allow-listing (MP.03) is tenant-attested. Cyber Essentials Plus MP.03 requires application allow-listing or strong sandboxing on high-risk devices. Secruna does not inspect endpoint policies, so the MP.03 IGP captures a tenant attestation rather than an auto-firing rule.
  • Annual renewal cycle is operator-managed. Cyber Essentials Plus is an annual certification. Secruna keeps the audit trail current but does not orchestrate the renewal booking with IASME — the customer handles that.

What Cyber Essentials Plus is

Cyber Essentials is the UK government's cyber security certification scheme, owned by the National Cyber Security Centre (NCSC) and delivered by IASME-registered Certification Bodies. The Plus tier adds an independent assessor visit on top of the basic self-assessment. The current scheme requirements live at https://www.ncsc.gov.uk/cyberessentials/overview and at https://www.cyberessentials.ncsc.gov.uk.

The certification covers five control families, each with technical controls every in-scope organisation must implement:

  1. Firewalls and internet gateways — boundary protection on every internet-facing device.
  2. Secure configuration — documented baselines, hardening, default-credential rotation.
  3. User access control — least privilege, MFA, admin separation, JML lifecycle.
  4. Malware protection — EDR / anti-malware coverage + application allow-listing for high-risk devices.
  5. Security update management — 14-day patching SLA for critical/high CVSS, 30 days otherwise, no EOL software in production.

Cyber Essentials Plus is required for many UK government supplier contracts under PPN 09/14 and the wider Cabinet Office supplier-assurance framework, and is widely referenced in UK private-sector RFPs across financial services, NHS supply chain, and defence prime supply chain.

What Secruna covers

Secruna ships Cyber Essentials Plus as a live rule book — rule_book/cyber_essentials_plus/v1/. Each control family becomes one or more Secruna rules with an NCSC citation, a connector signal match, and a customer_description body explaining what the control means and what evidence the assessor expects.

The v1 rule book covers:

  • Family 1 — Firewalls and internet gateways (3 IGPs): boundary firewalls, default-deny inbound, firewall administrative access.
  • Family 2 — Secure configuration (4 IGPs): baseline configuration, hardening application, default credentials, unused software / services.
  • Family 3 — User access control (4 IGPs): least privilege, MFA, admin separation, joiner / mover / leaver.
  • Family 4 — Malware protection (3 IGPs): anti-malware on user endpoints, anti-malware on servers, application allow-listing / sandboxing.
  • Family 5 — Security update management (4 IGPs): 14-day patching SLA, end-of-life software, vulnerability management cycle, update tracking.

How verdicts map to Cyber Essentials Plus outcomes

Secruna verdict Cyber Essentials Plus outcome What it means
fail Control failed Highest severity — a single FAIL in any family blocks certification at the assessor visit.
partial_pass Control partially in place Weakness with mandatory remediation before certification.
pass Control evidenced + verified Informational.
not_applicable Control out of scope for the tenant Residual fallback (e.g. application allow-listing on a fully cloud-native estate with no privileged-user workstations).

Severity ordering (highest first): fail > partial_pass > pass > not_applicable.

Using the evidence pack at assessor-visit time

The Cyber Essentials Plus Evidence Pack is generated from the dashboard under Exports → Cyber Essentials Plus Evidence Pack (org_admin role required). The file is a tenant-level PDF / CSV bundle:

  • Cover — tenant name, framework metadata, generation timestamp, document ID.
  • §1. Assessment summary — counts of IGPs at each verdict.
  • §2. Per-IGP evidence by control family — one section per family (FW / SC / UAC / MP / SU), one row per IGP with the verdict and a short evidence summary.
  • §3. Gaps surfaced for assessment — failed + partial-pass IGPs surfaced separately so the assessor sees the remediation list at a glance.
  • §4. Audit trail — last 90 days of platform activity material to the evidence pack.

Filename: secruna-cyber-essentials-plus-evidence-{tenant_slug}-{date}.pdf (or .csv).

Handing over to the IASME-registered assessor

The IASME-registered Certification Body runs the technical verification at the visit. Hand the evidence pack to the assessor at the start of the visit so the technical verification runs against a known baseline:

  1. Assessor reviews the evidence pack cover + assessment summary.
  2. Assessor runs the technical verification procedure (sample workstation checks, vulnerability scan, MFA enforcement test).
  3. Per-control-family findings are cross-referenced to the Secruna evidence pack §2.
  4. Remediation list (Secruna §3 Gaps) becomes the assessor's findings list if any control is FAIL or PARTIAL_PASS.

Re-running after remediation

Verdicts re-evaluate on every discovery run. Refresh the evidence pack the same way the NCSC CAF + DS 05-138 packs work:

  1. Trigger a discovery run (Connections → Run discovery now) or wait for the scheduled run.
  2. Confirm the verdict has flipped to pass under the IGP detail page.
  3. Generate a fresh evidence pack — the new gap count appears on the cover.

What Secruna does NOT cover

  • The IASME-registered assessor procedure. Secruna provides the evidence pack; the assessor runs the technical verification.
  • On-premise endpoint inventory. Coverage of laptops / desktops / mobile devices on-prem is tenant-attested until the on-prem agent ships (Plan 139).
  • Application allow-listing inspection. MP.03 is tenant-attested.
  • Annual renewal orchestration. Booking the next assessor visit with IASME is the operator's responsibility.

Frequently asked

Q. We're a UK SME bidding for a Cabinet Office framework. Is Cyber Essentials Plus enough? For many UK government framework call-offs the Plus certificate is the cyber baseline. The buyer may add framework-specific overlays (e.g. additional supplier-assurance questionnaires). Secruna ships the Plus evidence pack — the buyer's specific overlay is operator work.

Q. We already hold NCSC CAF. Do we need Cyber Essentials Plus too? NCSC CAF is the UK gov + CNI gateway framework; Cyber Essentials Plus is the broader supplier-baseline certification. Some buyers ask for both. Many ask for only one of the two — confirm with the procurement team. The cyber posture signal Secruna collects powers verdicts across both frameworks, so the marginal cost of subscribing to both is close to zero.

Q. What's the difference between basic Cyber Essentials and Cyber Essentials Plus? Basic Cyber Essentials is a self-assessment questionnaire. Plus adds an independent IASME-registered assessor visit that verifies the technical controls against your live setup. Most procurement gates that name "Cyber Essentials" actually require the Plus tier; check the buyer's wording.

Q. How often does the certificate renew? Annually. Secruna keeps the audit trail continuous so the next assessor visit lands on a current evidence pack, not a 12-month-old snapshot.