Cyber Essentials Plus Checklist: The 2 Weeks Before Your Audit

14 to 10 days: freeze scope and check support

• Freeze the scope. Confirm it matches the scope of the Cyber Essentials certificate the audit is based on. No new offices, subsidiaries or cloud services added at the last minute.
• Freeze the device list. Export laptops, desktops, mobiles, tablets, servers and network devices from your management tools. Reconcile it against HR starters and leavers.
• Find unsupported software. Any operating system, browser or application that no longer receives vendor security updates must be updated, removed or isolated. Windows 10 needs particular care: see Windows 10 and Cyber Essentials.
• Check update state across the whole estate. Updates that fix vendor-rated critical or high-risk vulnerabilities (CVSS v3 7 or above, or with no vendor severity given) must be installed within 14 days of release. Applying all updates within 14 days is recommended, not mandatory. Anything behind now will still be behind on audit day unless you act.
• Confirm the CE date. CE Plus must be completed within three months of the CE certificate. Know your deadline.

9 to 7 days: accounts, MFA and exposure

• MFA on every cloud account. Check users and admins, including the ones people forget: shared mailboxes with sign-in enabled, contractors, break-glass accounts.
• No MFA bypass. Confirm legacy authentication and similar routes are blocked.
• Admin accounts. Separate admin and day-to-day accounts. Remove local admin rights from standard users who do not need them.
• Leavers. Disable accounts for anyone who has left.
• External exposure. List internet-facing IP addresses and services. Close anything you do not need, and make sure remaining services are patched.

6 to 4 days: preflight representative devices

The assessor will test a sample, but you do not choose it. Pick one device from each combination of operating system, build and role (for example a finance laptop on Windows 11, a Mac, an iPhone, an Android work phone) and check it yourself:

• All security updates installed, including browsers, PDF readers, Java and other third-party apps.
• Anti-malware running and current, or application allow-listing in place.
• Opening a test malicious-style attachment or download is blocked or warned on.
• The user is not a local administrator unless justified.
• The device locks and requires a PIN, password or biometric.

If a preflight device fails, assume every device with the same build has the same problem and fix the build, not just that machine.

3 to 2 days: evidence, access and logistics

• Confirm the audit date, time and whether testing is on-site or remote. See on-site vs remote CE Plus audits.
• Install any remote-access or scanning tool the assessor has asked for, and test it.
• Prepare admin access to your cloud tenant(s) so MFA settings can be shown.
• Tell sampled users (once known) to keep their devices charged, online and available.
• Have your device inventory and scope statement to hand.

24 hours before

• Run a final update check and restart devices that are waiting to reboot.
• Do not selectively patch only the devices you think will be sampled. It creates a false picture and does not reflect the declaration you made for the whole scope.
• Avoid major changes: no new software rollouts, no policy overhauls.

Audit day: who and what needs to be available

If something does fail on the day, read what happens after a failed CE Plus audit.

Sources

• NCSC Cyber Essentials resources, including the CE Plus Test Specification
• IASME Cyber Essentials FAQ