Cyber Essentials Plus Checklist: A 2026 Guide for UK SME Readiness

Why Cyber Essentials Plus Matters More Than Ever in 2026

Cyber threats targeting UK small and medium-sized businesses are not slowing down. In fact, the National Cyber Security Centre (NCSC) continues to report that SMEs remain disproportionately vulnerable — often because they lack the internal resource to implement and verify strong security controls. Cyber Essentials Plus certification has become one of the most credible ways for UK businesses to demonstrate that their defences are genuinely robust, not just documented on paper.

If you're preparing for certification in 2026, this Cyber Essentials Plus readiness guide will walk you through exactly what's required, how the audit process works, and what to do before your assessor arrives.

---

Cyber Essentials Plus vs Basic: Understanding the Difference

Before diving into the checklist, it's worth clarifying what distinguishes the two tiers.

Cyber Essentials (basic) is a self-assessment. You answer a questionnaire confirming that certain controls are in place. It's a credible starting point, but it relies entirely on your own declarations.

Cyber Essentials Plus goes significantly further. An independent, NCSC-accredited assessor conducts hands-on technical verification of your systems. They test your actual environment — not just your answers. That distinction matters enormously to government procurement bodies, enterprise clients, and insurers who increasingly require Plus-level certification as a condition of doing business.

In short: basic tells people you believe your controls are in place. Plus proves it.

---

The Five Technical Control Areas

The Cyber Essentials Plus requirements UK businesses must satisfy are built around five core control areas. These haven't changed fundamentally, but the 2025 Montpellier scheme update has tightened how they're assessed and what evidence is expected.

1. Firewalls and Network Boundary Controls

Every device connecting to the internet — whether on-premises or remote — must be protected by a properly configured firewall. Default passwords must be changed, unnecessary services disabled, and rules documented. For remote workers, this now explicitly includes home routers or software firewalls on individual devices.

2. Secure Configuration

Devices must be configured to reduce vulnerabilities from the outset. This means removing or disabling unnecessary software, changing default credentials, and enabling auto-lock features. Assessors will look at sample devices during the Plus audit, so this isn't theoretical — your endpoints need to be clean.

3. User Access Control

Only authorised individuals should have access to data and systems, and privilege should be limited to what each role genuinely requires. Admin accounts must not be used for day-to-day browsing or email. Multi-factor authentication (MFA) is now a hard requirement for all cloud services and remote access — not optional.

4. Malware Protection

All devices in scope must have active, updated malware protection. This can be achieved through traditional anti-malware software or, where appropriate, application allowlisting. The key word is active — licences must be current and definitions up to date at the point of assessment.

5. Patch Management

Software and operating systems must be patched within 14 days of a critical update being released. Any software that is end-of-life and no longer receiving security updates must either be removed from scope or segregated from the rest of your network. This is one of the most common failure points during Plus audits.

---

The Cyber Essentials Plus Audit Process: What to Expect

Understanding the Cyber Essentials Plus audit process helps you prepare rather than scramble. Here's how it typically unfolds:

1. Scope definition — You and your assessor agree which systems, devices, and users fall within scope. Getting this right early avoids surprises later.
2. Vulnerability scanning — The assessor runs authenticated scans against your in-scope devices to identify missing patches, open ports, and misconfigurations.
3. Device sampling — A selection of end-user devices (Windows, macOS, mobile) will be manually reviewed for configuration compliance.
4. External infrastructure testing — Internet-facing services are tested for unnecessary exposure and weak configurations.
5. Remediation window — If issues are found, you typically have a defined period to resolve them before a retest. This isn't automatic, so don't rely on it.

At Coreitech, we recommend completing a gap analysis at least six to eight weeks before your planned assessment date. This gives you enough time to remediate findings without rushing changes that could introduce new problems.

---

Cyber Essentials Plus Checklist: Pre-Assessment Actions

Use this checklist to gauge your readiness before engaging an assessor:

Firewall and Perimeter

• [ ] All firewalls reviewed and unnecessary ports closed
• [ ] Default credentials changed on all network devices
• [ ] Remote access restricted and documented

Endpoint Configuration

• [ ] All devices have auto-lock enabled (maximum 10 minutes)
• [ ] Guest accounts disabled
• [ ] Unnecessary software removed

Access Control

• [ ] MFA enforced on all cloud services (Microsoft 365, Google Workspace, etc.)
• [ ] Admin accounts separated from standard user accounts
• [ ] User access reviewed and any leavers removed

Malware Protection

• [ ] Anti-malware active on all in-scope devices
• [ ] Definitions updating automatically
• [ ] Licences valid and not expired

Patching

• [ ] All operating systems on supported versions
• [ ] Critical patches applied within 14 days
• [ ] Software inventory checked for end-of-life applications

General Readiness

• [ ] Scope document agreed with assessor
• [ ] IT documentation up to date
• [ ] Previous Cyber Essentials (basic) certification current (recommended before applying for Plus)

---

Common Reasons UK SMEs Fail Cyber Essentials Plus

The most frequent failure points seen during UK SME cyber security certification assessments are:

• Outdated software — particularly legacy line-of-business applications that haven't been updated in years
• MFA not enforced universally — one account without MFA is enough to fail the control
• Inconsistent patching — particularly on devices used by remote or hybrid workers
• Overprivileged accounts — staff with local admin rights on their own devices without documented justification
• Scope creep — poorly defined scope that brings in systems that aren't ready

Being aware of these issues before your assessment is far preferable to discovering them during it.

---

Planning Your 2026 Certification Timeline

For most SMEs, a realistic timeline from decision to certification looks like this:

• Weeks 1–2: Internal audit and gap assessment
• Weeks 3–6: Remediation of findings
• Week 7: Apply for certification and schedule assessment
• Weeks 8–10: Assessment and any retest if required

If you're pursuing certification to meet a contract or procurement deadline, work backwards from that date and add buffer time. Rushing the process rarely ends well.

---

Get Expert Support Before Your Assessment

Achieving Cyber Essentials Plus certification without specialist support is possible, but for most SMEs it's slower, more stressful, and carries a higher risk of failure at assessment. Having a knowledgeable IT partner review your environment in advance makes a material difference.

If you'd like help preparing for your 2026 Cyber Essentials Plus assessment — from gap analysis through to remediation support — the team at Coreitech works with SMEs across London and the UK to get certification-ready efficiently and without unnecessary disruption to your business.

Call us on 0203 834 9728 or email sales@coreitech.co.uk to arrange an initial conversation. There's no obligation, and we'll give you a straight assessment of where you stand.