You've been asked for Cyber Essentials Plus, and somebody has suggested booking an assessor next week. Before agreeing, find out what needs to be ready and who will be available to help. A date in the diary is only useful if the right people and devices can be there.
Plus adds a technical audit to the verified self-assessment. IASME's certification guide explains that it checks the same five technical controls. The difference is that an assessor checks their implementation in your systems. This guide suggests how a small business can organise the preparation without turning it into another full-time job.
Put the deadlines on one calendar
You must already hold Cyber Essentials, and the Plus scope must match it. IASME's timelines guidance sets a three-month window from achieving the self-assessment certification. An assessor can allow up to 30 days to fix an issue, but this must still fit inside that window. It isn't an automatic extension.
Ask your Certification Body to confirm the relevant dates in writing. Put the proposed audit, staff holidays, important business deadlines and any available retest time on the same calendar. Booking the final possible week leaves very little room for an ordinary problem, such as the person with the right access being off sick.
If a customer needs the certificate for a contract, explain the schedule to whoever handles that relationship. Avoid promising a pass date before you know what work remains.
Give the assessor a picture of the real business
Bring together the agreed scope, your device information, the cloud services you use and the people who manage them. Check that the information reflects today's setup. A laptop list from before a recruitment round won't be much help.
Imagine a small design firm with office PCs, two remote Mac users and an outside IT provider. Its preparation call should include the remote machines and the person who can answer questions about cloud accounts. The office manager shouldn't discover halfway through the audit that nobody knows who controls a service.
For each important system, name a business contact and a technical contact. If both roles belong to one person, record an alternative for when they're unavailable. Keep passwords, recovery codes and customer documents out of the planning sheet.
Ask what access and availability are needed
IASME describes an audit that can take place remotely or on site. It includes external vulnerability scanning and checks on a representative device sample, covering the operating systems in use. Controls such as software updates, malware protection, user privileges and cloud MFA are examined. Your Certification Body determines the applicable testing and explains what it needs.
Ask these questions before the appointment:
- Which colleagues need to attend, and for how long?
- How will remote workers make their devices available?
- What approved access will the assessor need, and how will it be removed afterwards?
- Are there planned tests that need the agreement of a hosting or support provider?
- Who can authorise a change if a problem is found?
Don't send administrator passwords in an ordinary email to save time. Agree the access arrangement through a verified contact at the Certification Body. Include your IT provider early enough to resolve practical questions.
Finish the preparation across the whole scope
An audit sample isn't a list of the only devices that matter. Ask your provider to investigate missing, offline or failing devices in its management reports before assessment day. A report should lead to a completed action, rather than a growing list of exceptions nobody owns.
For example, a fictional practice might find that its spare reception laptop hasn't connected for several weeks. The useful question is whether it is still used and properly maintained. Moving it to a cupboard without settling that question doesn't explain its status.
Use the NCSC requirements as the control reference. Our patching workflow can help you organise unfinished update work. The preparation routine here is our suggestion, not an additional scheme requirement.
Understand the current retest rules
IASME's April 2026 update says a failed initial update-management sample requires remediation, a recheck of the original sample and testing of a new random sample. A second failure leads to revocation of the verified self-assessment certificate. The update also prevents changing self-assessment answers in response to Plus test results once testing has begun.
Discuss unresolved issues before testing starts. Under the current Danzell process, IASME says self-assessment non-conformities must be resolved before moving to Plus. Don't treat the appointment as a way to find out whether a known gap is acceptable.
If the assessor reports a problem, record the affected systems, the person fixing it and the agreed next step. Ask them to explain an unfamiliar finding. Avoid hurried changes that nobody can reverse or verify.
Keep one useful handover record
After the assessment, retain the result, agreed follow-up work and the contact details you'll need next time. Confirm that temporary access has been dealt with and tell the team when normal arrangements resume.
Assign ongoing tasks to the people who actually perform them. A certificate won't restart a stalled update or remove an old account for you. Good preparation makes those everyday jobs clearer, which is useful long after the audit appointment ends.