Cyber Essentials Plus certification requires organisations to undergo a series of internal and external vulnerability tests.
The internal scan checks patch levels and system configurations, while the security and anti-malware test ensures that the organisation’s systems are resistant to malicious email attachments and web-downloadable binaries.
The following internal tests are required for Cyber Essentials Plus:
- Inbound email binaries and payloads.
- Browser malicious and non-malicious file download test.
- Authenticated vulnerability and patch verification scan.
- Account Separation to confirm standard users do not have administrative privilege.
- Multi-Factor Authentication Check
The external scan also checks the patch levels and system configurations, but of the public facing infrastructure. The following external tests are required for Cyber Essentials Plus:
- Unauthenticated vulnerability and patch verification scan.
We provided daily vulnerability scan reports using Qualys, enabling the client to track and address any issues in near real time. Alongside these reports, we supplied clear remediation guidance and supporting documentation to help the client prioritise and implement fixes efficiently.
The client already had a strong technical foundation in place, using a suite of well-configured security tools:
- SentinelOne antivirus for advanced endpoint protection
- Proofpoint for email security
- Keeper Security as a password manager
- Ubiquiti Cloud Console to manage firewall policies and configurations
- Microsoft 365 to enforce MFA and SSO organisation-wide
These technologies, coupled with the client’s adherence to Cyber Essentials best practices, made the compliance process exceptionally smooth. Its proactive approach to patch and vulnerability management, antivirus configuration, firewall rules, multi-factor authentication, password policy and user access controls aligned closely with the scheme’s requirements.
Daily Qualys reports enabled the client to supplement its SentinelOne monitoring, identifying any residual vulnerabilities not detected by the endpoint platform – including those with lower risk scores. Any high or critical issues were resolved rapidly, thanks to effective collaboration between our team and the client’s in-house IT staff.
Our engagement reflected IT Governance’s core values:
- Solving real business problems
- Delivering measurable results
- Exceeding expectations through open and honest communication