Cyber Essentials
Cyber Essentials Plus Remote Testing Checklist
This checklist is designed to guide you through the remote testing process for Cyber Essentials Plus.
Requirements for Cyber Essentials Plus Assessment Day
Our assessments are primarily conducted remotely, necessitating a systematic approach to ensure a thorough evaluation. (For more details, information will be provided upon acceptance of the Cyber Essentials Plus quote.)
On the day of your Cyber Essentials Plus assessment, please ensure the following:
- An administrative staff member must be available throughout the assessment.
- This individual should possess network knowledge and authorisation to access all devices in the sample.
- They must be able to start and stop necessary services on devices, as our scanners require specific services to be operational.
- The remote assessor should have visibility of the administrator’s screen. Preferred screen-sharing methods include TeamViewer, Microsoft Quick Assist, or Microsoft Teams, though other options can be discussed.
- The administrator must be capable of viewing or controlling the required sample of machines, whether located on a single site or multiple sites. Ideally, one machine should be able to access all other sample machines for vulnerability scanning and screen sharing.
- Live, functional email addresses must be provided on the Asset Declaration form (sent prior to testing) to facilitate the delivery of blank test files for email verification.
- Ensure the vulnerability scanner software is fully installed (we will provide a download link and instructions).
If you are using advanced antivirus software like CrowdStrike, please note that we cannot verify its functionality with our test files. We will manually confirm installation per vendor recommendations. If any requirements cannot be met, please inform us in advance for further discussion.
Remote Access Software
Before the assessment day, ensure that the remote access software is downloaded on the designated computer for scans. Alternatively, we may have set up a screen-sharing session via Teams or Quick Assist. An assessor will contact you 1-3 days before the Cyber Essentials Plus test, expecting the scanner to be installed on the assigned machine (instructions will be provided).
Device Sample Calculation
The sample size is determined based on the number of each operating system as follows:
| Number of Each OS | Sample Size |
|---|---|
| 1 | 1 |
| 2-5 | 2 |
| 6-19 | 3 |
| 20-60 | 4 |
| 61+ | 5 |
If you change the operating system versions on devices after submitting the Asset Declaration form, please notify us before the assessment, as this will affect sample size.
For Windows 10, versions are categorised by edition and feature version (e.g., Windows 10 Pro v1909). If you have multiple versions, ensure the assessor tests the required number from each version.
Mobile phones accessing company information (e.g., emails) are also included in the assessment scope. The assessor will review the relevant number of Android and iOS devices as outlined in the table above.
All servers on the in-scope network will also be sampled according to their operating system, regardless of internet access.
Testing Scope for Cyber Essentials Plus
The Cyber Essentials Plus assessor will conduct various tests as outlined in the Illustrative Test Specification available on the NCSC website.
External Scanning
Ahead of the assessment, you will receive an Asset Declaration form to list protections against password guessing for any publicly accessible login prompts. On assessment day, you may need to provide evidence of your security measures.
Email Tests
We will send test files, including benign viruses, to evaluate your email security. The goal is for these files to be blocked by your antivirus software.
URL Checks
This test ensures that browsers are configured to prevent files from being executed without adequate warnings.
Device Scanning for Patch Compliance
This is often the most complex part of the Cyber Essentials Plus test. Ensure that a company representative is available to assist the assessor.
Assessment Procedure
A start time and screen-sharing method will be discussed during the preparatory call. The following steps will be taken:
- Confirm email addresses for sending test emails and the screen share link.
- Conduct screen sharing to initiate the test emails.
- The assessor will verify the IP address and ensure it aligns with the Asset Declaration Form.
- Test the anti-virus software to ensure it is up to date.
- Ensure the correct sample of machines is targeted for scanning.
If you have any questions regarding the Cyber Essentials Plus checklist, please reach out for assistance.
Before diving into this checklist, we recommend reviewing our detailed guide on preparing for the Cyber Essentials Basic assessment.
For pricing details regarding Cyber Essentials Basic, please refer to our costs and packages page.