Cyber Essentials 8: prepare for Plus, handle findings and keep the certificate useful

Agree the clock and scope before booking people

Plus uses the same scope as the basic assessment and adds independent technical verification. IASME's public guidance describes completion within three months of basic certification; its timeline page also uses a 90-day description. Ask the certification body to confirm your exact final date in writing. Do not assume calendar months and 90 days always mean the same day.

Remediation time sits inside that overall window. Do not schedule the first test so late that a permitted retest cannot fit. Ask about fees, site access, remote workers, test accounts and the handling of unavailable devices. The assessor determines the sampling method; you cannot prepare only the computers you would like them to choose.

The publicly linked Plus test specification is version 3.2, dated April 2025. Read it alongside the current v3.3 requirements and IASME's Danzell guidance. The document numbers are not interchangeable. Confirm the current test plan with your certification body rather than inventing a “v3.3 Plus specification”.

Arrange a normal, testable environment

The technical specification covers external exposure, authenticated vulnerability checks, malware-protection tests, MFA and account separation. Give the assessor accurate network and cloud information and the permissions needed for agreed testing. Identify the right owners for public addresses; scanning a shared provider's address without authorisation is not acceptable preparation.

Ensure representative staff and administrators can attend. Have remote devices powered, connected and available as agreed. Explain genuinely unavailable equipment promptly. Do not substitute a specially rebuilt laptop for a selected production device or temporarily remove controls to make a demonstration look tidy.

Agree a test contact, a stop procedure if business services are affected and the secure transfer of results. Give security monitoring staff the expected test window and identifiers, while preserving ordinary protection. Any scoped temporary access must be authorised, tracked and removed afterwards. Use assessor-provided safe test arrangements, never live malware.

Understand the Danzell patch retest change

IASME's current Danzell guidance says missing required updates found in the first sample must be fixed across the entire assessed scope. The original failed devices are retested and a second random sample checks that remediation reached beyond them. The work and second sample must fit within the permitted 30-day remediation window and overall completion limit.

If the same missing fixes are found in that second sample, Plus fails and the basic certificate can be revoked under the scheme's process. Failure to remedy the original missing updates in the permitted window can also lead to revocation. There is no fresh remediation window for the second sample. Ask the assessor to explain the specific finding, applicable process and dates before work starts.

The public Danzell page has nuanced wording about different vulnerabilities discovered in the second sample, including advisories and possible retesting. Do not treat that as permission to leave known vulnerabilities unresolved. Have the assessor classify the actual findings against current guidance; this series does not promise an automatic pass in that situation.

Fix the mechanism, then verify the population

Suppose fictional Merefield's first sample finds an outdated remote-support application. Updating that one machine is a correction. The next question is why the application escaped the update process: a separate installer, an excluded group or an unclear MSP responsibility can leave the same version elsewhere.

Search the full in-scope inventory for the affected software, repair the deployment mechanism and verify effective versions. Include devices that were offline during the first rollout. Give each unresolved item an owner and escalate before the deadline. Do not remove a failing device from the spreadsheet while it still accesses organisational services.

Keep factual disagreements separate from the fix. If you believe a scanner result is wrong, supply vendor evidence and version details to the assessor. Do not relabel it internally as a false positive without their review, or hide it from the report. The certification decision belongs to the scheme's authorised process.

Close the engagement properly

Attend the closing discussion, record findings and confirm what evidence is needed before a certificate can be issued. An encouraging verbal comment is not the certificate. Check the issued entity, scope and dates; remove temporary accounts and access, retain the report securely and hand outstanding advisories to operational owners.

Explain the outcome to management in terms of coverage and remaining work. Plus validates the specified controls through assessment; it does not replace broader incident response, recovery, supplier assurance or application security testing.

Make renewal less dramatic

Put support expiry, update failures, new cloud services, access changes and unmanaged-device discovery into ordinary operations. Choose review intervals that fit your estate and record them as organisational decisions. Reconcile inventories after material changes, and begin renewal planning early enough to investigate drift. Certification is renewed annually; the controls need to work between anniversaries.

Your final series output is a maintained scope register, control evidence, signed basic submission, Plus report and an operational ownership plan. Give the sponsor a list of unresolved improvements with owners and dates. That is a more useful end to the project than storing the certificate and abandoning the records that made it possible.

Check your understanding