How to Prepare and Apply
Prepare Cyber Essentials (CE) answers from current evidence. Cyber Essentials Plus (CE+) needs a CE pass and adds independent technical testing.
A Practical Application Path
Keep applicant, adviser and assessor roles clear.
Confirm the Need
Get the required level, legal applicant, scope and evidence deadline from the buyer. Clarify which group entities need to be covered.
Map Scope and Version
List work devices, cloud services and provider responsibilities. Use the requirements and question set applying to the account you will purchase; confirm any version question with the certification body.
Review Evidence and Fix Gaps
Ask system owners how the protections work. Give each gap or unknown an owner and due date. Your organisation or IT provider makes changes and supplies current evidence.
Choose a Body and Purchase
Use IASME’s self-led CE route or choose a licensed certification body. Arrange Plus directly with a body. Confirm scope, price, inclusions and dates, then purchase when nearly ready.
Approve and Submit
Enter answers through the official assessment platform. A board-level representative, business owner or equivalent approves accuracy. For multiple included entities, the signatory needs authority for all of them.
Respond and Record the Outcome
Answer assessor questions within the stated response deadline. Record the actual decision, certificate scope and dates. If progressing to Plus, confirm its testing arrangements and final completion date.
Before You Buy
Resolve these four points before opening the paid account.
- Applicant
- Legal entity, level, scope and due date are clear.
- Technology
- Device, cloud and provider owners can confirm operation and evidence.
- Open Gaps
- Each unknown has an owner, action date and certification body question if needed.
- Signatory
- A board-level representative, business owner or equivalent can review and approve the answers. For multiple included entities, confirm their authority for all.
Three Roles, One Accurate Application
The application depends on clear ownership, not on an adviser promising an outcome.
Hemanth Vishnu Advisory
Hemanth personally advises on scope, gaps, evidence and certification body handoff.
Applicant and IT Provider
Your organisation and provider confirm facts, approve and make changes, and supply evidence. The authorised signatory confirms the application’s accuracy.
Licensed UK Certification Body
Its assessor reviews CE or conducts agreed CE+ testing, handles queries and decides the outcome.
Fictional Example: Cloud Sign-In Is Unclear
A charity cannot confirm MFA, the extra sign-in check, or which administrator accounts its provider uses.
- Next Action
- Its IT owner requests current settings and assigns any change to an authorised provider contact.
- What This Settles
- The unknown remains open until the charity can verify the settings. The signatory reviews the evidence before approving the answer.
Preparing for Cyber Essentials Plus
Pass CE first, then complete Plus for the same scope in the required window. The certification body confirms testing, access, findings and the final date.